Behavioral task
behavioral1
Sample
JaffaCakes118_b6658a9962e40520139c1354b1cc4a8d.exe
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_b6658a9962e40520139c1354b1cc4a8d
-
Size
268KB
-
MD5
b6658a9962e40520139c1354b1cc4a8d
-
SHA1
0826499a2a0015b33ec0c2462353649cae3f97f5
-
SHA256
6298de11b00b42af03ff667017a27fc6c1a17bd79af6eb2483454f604004682e
-
SHA512
afa3792c244d2d62975ceed3cd151648f2d8db1fa8b4129e50c14dd96282030345d0e255ca85181b440c5f9a26e2d1399aee99278b3b8fa6d0bdececef7fbfd1
-
SSDEEP
6144:p5q4MjTknKcjwzfxOZ9TdIEHFJW4CBEcdCfY1xaiqfIpvN20VEbVDy:JATkKbbxI9CEHFJzCCsCfYWivpvN20T
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_b6658a9962e40520139c1354b1cc4a8d
Files
-
JaffaCakes118_b6658a9962e40520139c1354b1cc4a8d.exe windows:4 windows x86 arch:x86
3039a04ea8ae6568d1f1f38e4ea28e48
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
crypt32
CertOIDToAlgId
CryptMsgOpenToDecode
CertDuplicateCertificateContext
CryptMsgGetParam
CertEnumCertificatesInStore
CertDuplicateStore
CryptMsgUpdate
CertGetNameStringA
CertCloseStore
CertCompareCertificateName
CertFindCertificateInStore
CertFreeCertificateContext
CertOpenStore
CryptDecodeObject
CryptMsgClose
wintrust
WinVerifyTrust
WTHelperGetProvSignerFromChain
WTHelperGetProvCertFromChain
WTHelperProvDataFromStateData
kernel32
GetLastError
GetModuleHandleA
GetModuleFileNameW
MoveFileW
MoveFileA
GetModuleFileNameA
MultiByteToWideChar
WaitForSingleObject
CreateSemaphoreA
SetEvent
CreateEventA
GetSystemTime
FreeLibrary
InitializeCriticalSection
LoadLibraryA
GetExitCodeThread
WaitForMultipleObjects
GetVersionExA
GetCurrentThreadId
LoadResource
Sleep
GetSystemInfo
RaiseException
ExitProcess
GetCurrentProcess
HeapCreate
IsBadWritePtr
TlsAlloc
GetStartupInfoA
GetEnvironmentStringsW
SetUnhandledExceptionFilter
GetACP
GetOEMCP
GetCPInfo
IsBadReadPtr
IsBadCodePtr
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
lstrcmpA
GetProcAddress
user32
CharUpperA
advapi32
RegSetValueExA
CryptReleaseContext
CryptAcquireContextA
CryptCreateHash
CryptDestroyHash
CryptHashData
RegQueryValueExA
RegDeleteKeyA
RegCreateKeyExA
RegOpenKeyExA
RegEnumKeyA
RegCloseKey
CryptGetHashParam
ole32
StringFromCLSID
scecli
SceStartTransaction
SceRegisterRegValues
SceAddToNameList
DllUnregisterServer
SceDcPromoCreateGPOsInSysvolEx
SceGetServerProductType
kbdkaz
KbdLayerDescriptor
Sections
UPX0 Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.kREZn Size: 4KB - Virtual size: 415KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.edata Size: 91KB - Virtual size: 122KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ocUcy Size: 512B - Virtual size: 75KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 6KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.XtjX Size: 2KB - Virtual size: 285KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 131KB - Virtual size: 227KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xQ Size: 5KB - Virtual size: 793KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ