Behavioral task
behavioral1
Sample
JaffaCakes118_8a867fad855aa30a54a0d6d5139d6413.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_8a867fad855aa30a54a0d6d5139d6413.exe
Resource
win10v2004-20250314-en
General
-
Target
JaffaCakes118_8a867fad855aa30a54a0d6d5139d6413
-
Size
156KB
-
MD5
8a867fad855aa30a54a0d6d5139d6413
-
SHA1
b6564c213a7d0d8f98b692d62d2a551db8a5266a
-
SHA256
0d347e55a594bb76b76f5c707d26a4c810a64838673073a47e0537eda1cd2f59
-
SHA512
746166f9107e694ab0001401874e7cd3100372c881500e604ffaf1a735a44ffcb1449227000d75805f6f2ebbab7533b9d7984960153683409f4f13875ff9d129
-
SSDEEP
3072:JoGT5p1i7XHgoNRUa5SP9dT8H6//Z7qE8wrwUzERy1vs:S25p1i7dOXr0w8+nls
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_8a867fad855aa30a54a0d6d5139d6413
Files
-
JaffaCakes118_8a867fad855aa30a54a0d6d5139d6413.exe windows:4 windows x86 arch:x86
04e395eddebf9aaca2d8111a54474c40
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
OpenMutexW
LocalFree
LocalHandle
LocalAlloc
lstrcmpW
CreateMutexW
lstrlenW
GetPrivateProfileStringW
GetPrivateProfileIntW
GetCurrentProcess
SetFileAttributesW
GetFileAttributesW
WriteProfileStringW
RemoveDirectoryW
LoadLibraryA
CloseHandle
GlobalAlloc
CreateFileW
GetCPInfo
GetFileSize
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsA
GetModuleFileNameA
FreeEnvironmentStringsW
TerminateProcess
ExitProcess
UnhandledExceptionFilter
VirtualFree
HeapCreate
VirtualAlloc
GetProcAddress
GetVersion
HeapDestroy
GetStartupInfoA
GetModuleHandleA
GetCommandLineA
HeapFree
GetStringTypeW
HeapAlloc
GetStringTypeA
LCMapStringA
RtlUnwind
GetFileType
GetStdHandle
SetHandleCount
GetOEMCP
WriteFile
ReleaseMutex
GetACP
GetWindowsDirectoryW
DeleteFileW
MoveFileExW
GetSystemDirectoryW
MultiByteToWideChar
LCMapStringW
lstrcpyW
GlobalFree
GlobalLock
ReadFile
GlobalUnlock
GetLastError
lstrcatW
Sleep
user32
LoadStringW
GetMessageW
MessageBoxW
DispatchMessageW
FindWindowExW
ExitWindowsEx
DefWindowProcW
wsprintfW
SendMessageW
SetWindowPos
BeginPaint
GetSystemMetrics
GetClientRect
SetForegroundWindow
GetSysColor
PostQuitMessage
DrawTextW
EndPaint
LoadIconW
ShowWindow
UpdateWindow
CreateWindowExW
RegisterClassExW
GetFocus
TranslateMessage
gdi32
GetTextExtentPoint32W
SetTextColor
SetBkMode
winspool.drv
DeletePrinter
DeletePrinterConnectionW
OpenPrinterW
EnumJobsW
ClosePrinter
AbortPrinter
DeletePrinterDriverW
EnumPrintersW
advapi32
RegOpenKeyExW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteValueW
CloseServiceHandle
RegQueryValueExW
RegDeleteKeyW
RegCloseKey
ControlService
DeleteService
OpenServiceW
QueryServiceStatus
OpenSCManagerW
shell32
SHGetPathFromIDListW
SHGetSpecialFolderLocation
ole32
CoTaskMemAlloc
CoTaskMemFree
Sections
.text Size: 31KB - Virtual size: 30KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 1024B - Virtual size: 935B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: 104KB - Virtual size: 252KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE