Static task
static1
Behavioral task
behavioral1
Sample
f122fd500de1da38c291c8033c42c7d2_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f122fd500de1da38c291c8033c42c7d2_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f122fd500de1da38c291c8033c42c7d2_JaffaCakes118
-
Size
269KB
-
MD5
f122fd500de1da38c291c8033c42c7d2
-
SHA1
28a731c619c629e53e8fad312ab5239bba5bf92e
-
SHA256
7d6c4fdceb9e8679982ed8262ce417ae0690dbb3758f41933982d3021399806a
-
SHA512
23c2cbdb6539d6a2b47130b56e6f90ae98a776a4b2ed8fecd950f7cef5fdab8d0d3aacb59280c377414cfb85380c6bb18ab6295be9d60dea3b10cbf7c9fc4f44
-
SSDEEP
6144:MQvj1foGeiyCVU+LDQoXTaCgy3c2PZXapobzcX71f3qvR:s6VUu8oDaHuppbzcX79q
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f122fd500de1da38c291c8033c42c7d2_JaffaCakes118
Files
-
f122fd500de1da38c291c8033c42c7d2_JaffaCakes118.exe windows:4 windows x86 arch:x86
814eea109817b211dfc8b66a2b1c4c40
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
StrRetToStrW
kernel32
LeaveCriticalSection
CreateFileW
SetThreadPriority
ResetEvent
CreateEventW
DeviceIoControl
GetThreadPriority
DeleteCriticalSection
GetDiskFreeSpaceExW
CloseHandle
GetWindowsDirectoryW
GetVolumeInformationW
ExpandEnvironmentStringsW
FindFirstFileW
FindClose
GetPrivateProfileStringW
FindNextFileW
GetSystemDirectoryW
SetLastError
SetFilePointer
ReadFile
WriteFile
FlushFileBuffers
GetTempFileNameW
MoveFileExW
DeleteFileW
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
HeapReAlloc
HeapAlloc
HeapFree
GetProcessHeap
IsDebuggerPresent
GetSystemTimeAsFileTime
GetCurrentThreadId
GetLogicalDrives
WaitForSingleObject
CreateDirectoryW
SetErrorMode
GetDriveTypeW
TryEnterCriticalSection
GetFileSize
SetUnhandledExceptionFilter
UnhandledExceptionFilter
lstrcmpA
VirtualAlloc
advapi32
RegEnumValueW
GetUserNameW
RegEnumKeyExW
RegCloseKey
RegOpenKeyExW
StartServiceW
RegOpenKeyW
RegQueryValueExW
OpenServiceW
OpenSCManagerW
CloseServiceHandle
RegFlushKey
shell32
SHGetDesktopFolder
SHGetMalloc
SHGetFolderPathW
ole32
CoInitialize
CoTaskMemFree
CoUninitialize
query
FsCiShutdown
LoadIFilter
EndCacheTransaction
DoneCIPerformanceData
BindIFilterFromStorage
DllGetClassObject
kbdsp
KbdLayerDescriptor
Sections
.text Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.LTWTV Size: 512B - Virtual size: 390B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.AUFS Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Rfn Size: 512B - Virtual size: 819B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hA Size: 1KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.kc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.F Size: 1024B - Virtual size: 867B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rrtSu Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 213KB - Virtual size: 352KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.PAgD Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.qNP Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.cwfoJD Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.I Size: 1KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ