Static task
static1
Behavioral task
behavioral1
Sample
ebc74288f42a0c390a0eddd12807a9d2_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
ebc74288f42a0c390a0eddd12807a9d2_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
ebc74288f42a0c390a0eddd12807a9d2_JaffaCakes118
-
Size
10.6MB
-
MD5
ebc74288f42a0c390a0eddd12807a9d2
-
SHA1
7c3de60bd047eb1e3cbacbbbafd48354a8acb875
-
SHA256
e2ddc3acaa676596c8a5922c449f9d235610854cf9a8796885ae547726fc99bb
-
SHA512
6a6bdef1a17f93adab911e8ce9f6b1344332da0ab5d89db22d38f4d44d5a28195f3efba20051549e944ebc9a2078ae3df9cf4d8499b50f2ea4f246a4b0c92f75
-
SSDEEP
24576:8pvxh4TO4OsVZRzALvx44ApeIknRC9EpXdPC+P+NvZLuksQtZaemNmWxNxxfc25u:K0TYsq24lICNPoNvtshwYzRDdYfX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ebc74288f42a0c390a0eddd12807a9d2_JaffaCakes118
Files
-
ebc74288f42a0c390a0eddd12807a9d2_JaffaCakes118.exe windows:5 windows x86 arch:x86
b556371bf3a4933eccaf19b708d3f250
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetThreadContext
FindFirstFileW
SetThreadContext
CreateProcessW
WaitForSingleObject
GetSystemDirectoryW
Sleep
ReadProcessMemory
TerminateProcess
GetLastError
GetProcAddress
VirtualProtectEx
VirtualAllocEx
GetLocalTime
GetModuleHandleA
FindNextFileW
CloseHandle
WriteProcessMemory
ResumeThread
EncodePointer
DecodePointer
GetCommandLineW
HeapSetInformation
GetStartupInfoW
RaiseException
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
HeapFree
IsProcessorFeaturePresent
HeapSize
GetModuleHandleW
ExitProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
WriteFile
GetStdHandle
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapReAlloc
LeaveCriticalSection
EnterCriticalSection
LoadLibraryW
RtlUnwind
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
WideCharToMultiByte
LCMapStringW
MultiByteToWideChar
GetStringTypeW
Sections
.text Size: 385KB - Virtual size: 385KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 62KB - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ