Behavioral task
behavioral1
Sample
JaffaCakes118_bf10d8c20665b9cc32db9ea5a40541ce.exe
Resource
win10v2004-20250410-en
General
-
Target
JaffaCakes118_bf10d8c20665b9cc32db9ea5a40541ce
-
Size
268KB
-
MD5
bf10d8c20665b9cc32db9ea5a40541ce
-
SHA1
fa391426b4207e7d395ec59cbda10e7ca5bbf8ba
-
SHA256
037d38b1af1120268553a2070db9637f2cad70354863ffe6399717a16cbbbe45
-
SHA512
7538858bd4dec9da6fb0f69a23492942143d961f850f258f45fd47e549f9eebaf7c3d53487abaead741a9bd433a30c1e3467b442750bba252933c59c14e6a88b
-
SSDEEP
6144:m5q4MjTknKcjwzfxOZ9TdIEHFJW4CBEcdCfY1xaiqfIpvN20VEbVDy:CATkKbbxI9CEHFJzCCsCfYWivpvN20T
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_bf10d8c20665b9cc32db9ea5a40541ce
Files
-
JaffaCakes118_bf10d8c20665b9cc32db9ea5a40541ce.exe windows:4 windows x86 arch:x86
3039a04ea8ae6568d1f1f38e4ea28e48
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
crypt32
CertOIDToAlgId
CryptMsgOpenToDecode
CertDuplicateCertificateContext
CryptMsgGetParam
CertEnumCertificatesInStore
CertDuplicateStore
CryptMsgUpdate
CertGetNameStringA
CertCloseStore
CertCompareCertificateName
CertFindCertificateInStore
CertFreeCertificateContext
CertOpenStore
CryptDecodeObject
CryptMsgClose
wintrust
WinVerifyTrust
WTHelperGetProvSignerFromChain
WTHelperGetProvCertFromChain
WTHelperProvDataFromStateData
kernel32
GetLastError
GetModuleHandleA
GetModuleFileNameW
MoveFileW
MoveFileA
GetModuleFileNameA
MultiByteToWideChar
WaitForSingleObject
CreateSemaphoreA
SetEvent
CreateEventA
GetSystemTime
FreeLibrary
InitializeCriticalSection
LoadLibraryA
GetExitCodeThread
WaitForMultipleObjects
GetVersionExA
GetCurrentThreadId
LoadResource
Sleep
GetSystemInfo
RaiseException
ExitProcess
GetCurrentProcess
HeapCreate
IsBadWritePtr
TlsAlloc
GetStartupInfoA
GetEnvironmentStringsW
SetUnhandledExceptionFilter
GetACP
GetOEMCP
GetCPInfo
IsBadReadPtr
IsBadCodePtr
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
lstrcmpA
GetProcAddress
user32
CharUpperA
advapi32
RegSetValueExA
CryptReleaseContext
CryptAcquireContextA
CryptCreateHash
CryptDestroyHash
CryptHashData
RegQueryValueExA
RegDeleteKeyA
RegCreateKeyExA
RegOpenKeyExA
RegEnumKeyA
RegCloseKey
CryptGetHashParam
ole32
StringFromCLSID
scecli
SceStartTransaction
SceRegisterRegValues
SceAddToNameList
DllUnregisterServer
SceDcPromoCreateGPOsInSysvolEx
SceGetServerProductType
kbdkaz
KbdLayerDescriptor
Sections
UPX0 Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.kREZn Size: 4KB - Virtual size: 415KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.edata Size: 91KB - Virtual size: 122KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ocUcy Size: 512B - Virtual size: 75KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 6KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.XtjX Size: 2KB - Virtual size: 285KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 131KB - Virtual size: 227KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xQ Size: 5KB - Virtual size: 793KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ