Static task
static1
Behavioral task
behavioral1
Sample
f214fe1a20a18a19b1bb253667912af7_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f214fe1a20a18a19b1bb253667912af7_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f214fe1a20a18a19b1bb253667912af7_JaffaCakes118
-
Size
522KB
-
MD5
f214fe1a20a18a19b1bb253667912af7
-
SHA1
adc3b7e30c6cf1b4d7e2fafd524f9c1cc3de44ec
-
SHA256
559e257b6fa06065ba96b579a1e4cc3a86fbba847cec8a30d1b2b1fb4129b0aa
-
SHA512
a2c95c7de4443322cecfa9e8137d3082f00faefaa8b5c6dd80ad4e97f29717396d2a9001d560ed65c19c70d3d871dba8490850c480633c4786a1471c7386c889
-
SSDEEP
12288:dhsb6UVCe38zhFoHn6j16ajsRENjgsUy4QOBiRp4RW:dakeMzLOn6joakkjg5y4QOBiz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f214fe1a20a18a19b1bb253667912af7_JaffaCakes118
Files
-
f214fe1a20a18a19b1bb253667912af7_JaffaCakes118.exe windows:4 windows x86 arch:x86
54cec3953834a63515a4539cd403b4a1
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
comdlg32
ReplaceTextA
FindTextW
LoadAlterBitmap
ChooseColorW
wininet
SetUrlCacheEntryInfoW
ShowCertificate
RetrieveUrlCacheEntryStreamA
FtpCommandW
DeleteUrlCacheGroup
InternetShowSecurityInfoByURLA
CommitUrlCacheEntryA
FtpPutFileEx
advapi32
RegEnumValueA
RegOpenKeyW
CryptImportKey
CryptContextAddRef
CryptCreateHash
RegQueryValueExA
LookupPrivilegeNameA
RegQueryValueW
ReportEventW
CryptDuplicateKey
CryptEnumProvidersA
RegLoadKeyA
LogonUserW
RegQueryInfoKeyA
CreateServiceA
RegEnumValueW
CryptDuplicateHash
CryptGetDefaultProviderW
CryptSetHashParam
comctl32
InitCommonControlsEx
kernel32
LocalAlloc
GetFileType
GetCurrentProcessId
LoadLibraryA
UnlockFile
EnumSystemLocalesA
CompareStringA
GetVolumeInformationW
FreeEnvironmentStringsW
GetLocaleInfoA
SetStdHandle
GetEnvironmentStrings
FlushFileBuffers
LCMapStringW
GetSystemTimeAsFileTime
SetEnvironmentVariableA
GetModuleHandleA
VirtualProtect
SetConsoleScreenBufferSize
GetSystemInfo
GetLocaleInfoW
GetDateFormatA
HeapAlloc
GetTickCount
lstrcpyA
MultiByteToWideChar
GetModuleFileNameA
InitializeCriticalSectionAndSpinCount
IsBadWritePtr
WriteFile
GetLastError
WideCharToMultiByte
EnterCriticalSection
GetTimeZoneInformation
UnhandledExceptionFilter
RtlUnwind
SetHandleCount
CreateMutexA
CloseHandle
IsValidLocale
HeapCreate
HeapReAlloc
HeapDestroy
CreateNamedPipeA
SetThreadContext
ReadFile
SetThreadPriority
IsValidCodePage
FindFirstFileA
InitializeCriticalSection
TerminateProcess
InterlockedCompareExchange
OpenFile
TlsSetValue
GetTimeFormatA
OpenMutexA
GetCPInfo
GlobalAddAtomW
TlsAlloc
GetDateFormatW
GetStringTypeA
LCMapStringA
TlsFree
GetEnvironmentStringsW
GetCurrentThread
SetFilePointer
VirtualFree
CreateDirectoryA
VirtualQuery
SetLastError
GetPrivateProfileStructA
InterlockedExchange
GetOEMCP
GetStringTypeW
GetStartupInfoA
QueryPerformanceCounter
SetCurrentDirectoryA
HeapFree
GetCommandLineA
GetStdHandle
TlsGetValue
InterlockedIncrement
GetVersionExA
ExitProcess
LeaveCriticalSection
GetCurrentProcess
SetComputerNameW
GetUserDefaultLCID
DeleteCriticalSection
FreeEnvironmentStringsA
HeapSize
CompareStringW
VirtualAlloc
GetACP
LocalReAlloc
GetProcAddress
GetCurrentThreadId
user32
LoadMenuA
LoadMenuW
FrameRect
CheckMenuItem
RegisterClassExA
GetTopWindow
GetDCEx
IsRectEmpty
GetKeyboardLayoutNameW
GetMessageTime
CreateIconIndirect
CreateDialogIndirectParamW
IsWindowVisible
EnumDisplayDevicesW
GetCursorInfo
SetForegroundWindow
ImpersonateDdeClientWindow
GetSysColorBrush
WindowFromPoint
InSendMessageEx
UnhookWinEvent
GetUserObjectInformationA
GetTitleBarInfo
RegisterClassA
CharPrevW
Sections
.text Size: 194KB - Virtual size: 193KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 9KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 314KB - Virtual size: 314KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ