Static task
static1
Behavioral task
behavioral1
Sample
e9c1c097953973ef266913114ec78af2_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e9c1c097953973ef266913114ec78af2_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
e9c1c097953973ef266913114ec78af2_JaffaCakes118
-
Size
410KB
-
MD5
e9c1c097953973ef266913114ec78af2
-
SHA1
86a66269a6d94738bdaa79ddc64cb6a1021186c2
-
SHA256
fb2cada8f24b492c7df9c27c5afc454c87c38202026c97f2e6bedd1083b013b5
-
SHA512
1f9093756931e14582ed09035294115cad286dedd893ffab9211147ead57f5a75c079488589878f6929d16a0c88f0aed1ac60808b2acca69f801f8a391fac92f
-
SSDEEP
12288:uiRoVPu1OCogOtWWEpMwIvXWmws35SY/ib:L17ogOt8MNOmJoy0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e9c1c097953973ef266913114ec78af2_JaffaCakes118
Files
-
e9c1c097953973ef266913114ec78af2_JaffaCakes118.exe windows:4 windows x86 arch:x86
f11bfaae6da0f443902c3779baa4e963
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ExitProcess
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
LoadLibraryA
RtlUnwind
InterlockedExchange
VirtualQuery
HeapReAlloc
HeapAlloc
HeapFree
VirtualAlloc
CreateEventW
InterlockedDecrement
CreateMailslotA
GetDriveTypeW
SetPriorityClass
SetLastError
GetConsoleTitleA
GetStringTypeExW
TlsAlloc
GetTimeFormatW
GetFileType
GlobalHandle
GetVersionExA
SearchPathW
FindResourceA
TransmitCommChar
LockFile
CreateProcessW
BeginUpdateResourceA
OpenSemaphoreW
SetEndOfFile
GetStdHandle
GetSystemPowerStatus
OpenSemaphoreA
GlobalGetAtomNameA
PeekNamedPipe
CreateWaitableTimerW
ReadConsoleOutputAttribute
CreateEventA
WriteConsoleInputA
UnmapViewOfFile
Heap32Next
GetLogicalDriveStringsA
GetThreadSelectorEntry
UpdateResourceA
FlushViewOfFile
WaitForDebugEvent
FoldStringA
OpenFileMappingA
SetConsoleTitleW
GetWindowsDirectoryA
FillConsoleOutputCharacterW
FindClose
TransactNamedPipe
GetComputerNameA
SetThreadAffinityMask
GetThreadPriority
FindFirstFileExA
FindNextFileW
FileTimeToSystemTime
GetExitCodeProcess
GetNumberOfConsoleMouseButtons
EnumTimeFormatsW
ReadFile
CreateWaitableTimerA
GetPrivateProfileSectionNamesW
WritePrivateProfileStringW
lstrcpyW
FlushFileBuffers
FileTimeToLocalFileTime
GlobalWire
GetNumberFormatA
CreateThread
TerminateThread
SetLocaleInfoW
GetFileAttributesA
VirtualAllocEx
SetConsoleCtrlHandler
FoldStringW
SetEvent
EnumCalendarInfoExW
WriteConsoleOutputCharacterW
GetExitCodeThread
SetConsoleCursorPosition
CreateSemaphoreA
InterlockedExchangeAdd
DebugActiveProcess
ResetEvent
SetSystemTimeAdjustment
SetCurrentDirectoryA
AllocConsole
IsValidLocale
GlobalDeleteAtom
lstrcmpiA
WideCharToMultiByte
lstrcmpA
EnumSystemCodePagesA
GetConsoleOutputCP
CreateFileA
TlsGetValue
ExpandEnvironmentStringsW
advapi32
AbortSystemShutdownW
RegOpenKeyExA
AbortSystemShutdownA
CryptDestroyHash
RegCreateKeyExW
RegDeleteKeyW
DuplicateTokenEx
LogonUserA
RegCreateKeyW
CryptSignHashW
LookupPrivilegeValueW
CryptImportKey
RegQueryValueA
RegSetValueW
DuplicateToken
RegQueryInfoKeyW
InitializeSecurityDescriptor
RegSaveKeyW
CryptVerifySignatureA
CryptGetDefaultProviderW
CryptEnumProvidersW
RegOpenKeyExW
RegReplaceKeyA
CryptGetProvParam
CryptContextAddRef
RegSaveKeyA
RegCreateKeyExA
InitiateSystemShutdownA
RegQueryInfoKeyA
RegDeleteValueA
RegEnumValueW
RegQueryMultipleValuesA
RegLoadKeyA
LookupAccountNameW
LookupSecurityDescriptorPartsA
CryptEncrypt
LookupPrivilegeDisplayNameW
LogonUserW
CryptGetUserKey
RegOpenKeyA
CryptDuplicateKey
ReportEventA
RegEnumKeyW
CryptSetProviderW
RegDeleteValueW
RegQueryMultipleValuesW
RegSetValueA
RegReplaceKeyW
CryptHashSessionKey
CryptAcquireContextW
CryptGetKeyParam
RegConnectRegistryW
LookupAccountSidA
LookupAccountSidW
RegEnumValueA
InitiateSystemShutdownW
CryptGetHashParam
RegEnumKeyA
CryptSetProviderA
LookupPrivilegeDisplayNameA
RegQueryValueW
RegSetValueExW
RegEnumKeyExA
CryptGetDefaultProviderA
CryptExportKey
Sections
.text Size: 142KB - Virtual size: 141KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 248KB - Virtual size: 247KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ