Static task
static1
Behavioral task
behavioral1
Sample
f2fbb6bf368feb7244cf6b0be6394f3e_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f2fbb6bf368feb7244cf6b0be6394f3e_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f2fbb6bf368feb7244cf6b0be6394f3e_JaffaCakes118
-
Size
170KB
-
MD5
f2fbb6bf368feb7244cf6b0be6394f3e
-
SHA1
d426f260e937377ad2f1195904794c4ac1b8d6bc
-
SHA256
8c9f53eb0c8b14fde32b14a7c1f7ec82fd97af9b5c7a9e34c91ac51c8b126420
-
SHA512
e83d346cccb05b0d570cb0d8211c0a0b33c9e8cdf4c0137b679fa04cb9538c385267fb95c71031845a756dca004b58dd844ab0ebb866d32cc854a1b271bc3783
-
SSDEEP
3072:+6cpbetNSe92q0158JNlBGZZLe8ZTKemMoM+/UiO5f+qWQ:+6cBetke92q458h0xWJM+8XpOQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f2fbb6bf368feb7244cf6b0be6394f3e_JaffaCakes118
Files
-
f2fbb6bf368feb7244cf6b0be6394f3e_JaffaCakes118.exe .vbs windows:4 windows x86 arch:x86 polyglot
25328a1cbbfeec4e91ac0cffd08787fd
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrlenA
FindClose
FindFirstFileA
GetSystemDirectoryA
MoveFileExA
ReadFile
WinExec
GetTempFileNameA
GetTempPathA
SetFilePointer
lstrcpynA
CreateDirectoryA
FindNextFileA
ReleaseMutex
WaitForSingleObject
lstrcmpiA
lstrcpyA
lstrcmpA
GetEnvironmentVariableA
lstrcatA
GetDiskFreeSpaceA
GetModuleHandleA
Sleep
MoveFileA
GetLocalTime
GetCurrentProcess
FormatMessageA
GetLastError
GetComputerNameA
SetCurrentDirectoryA
MultiByteToWideChar
VirtualAlloc
VirtualFree
FileTimeToDosDateTime
SetEndOfFile
DosDateTimeToFileTime
ExitProcess
SetFileTime
SystemTimeToFileTime
CreateProcessA
GetWindowsDirectoryA
GetVersion
CreateMutexA
CreateSemaphoreA
CreateThread
SizeofResource
LockResource
LoadResource
FindResourceA
DeviceIoControl
HeapFree
HeapAlloc
GetProcessHeap
GetDriveTypeA
GetLogicalDrives
GetLogicalDriveStringsA
FileTimeToSystemTime
ReleaseSemaphore
OpenSemaphoreA
SetFileAttributesW
GetFileSize
CreateFileMappingA
MapViewOfFile
WriteFile
UnmapViewOfFile
CreateFileA
GetFileTime
CloseHandle
DeleteFileA
GetModuleFileNameA
CopyFileA
SetFileAttributesA
LoadLibraryA
GetSystemTime
GetProcAddress
user32
CharLowerBuffA
wsprintfA
DefWindowProcA
SetTimer
ShowWindow
PostQuitMessage
EndDialog
KillTimer
DialogBoxParamA
advapi32
InitializeSecurityDescriptor
LookupAccountNameA
AddAccessAllowedAce
SetSecurityDescriptorDacl
SetFileSecurityA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegSaveKeyA
RegOpenKeyExA
RegRestoreKeyA
RegCloseKey
RegSetValueExA
RegQueryValueExA
InitializeAcl
shell32
SHChangeNotify
ole32
CoInitialize
CoUninitialize
msvcrt
strrchr
_strcmpi
atol
isdigit
_except_handler3
memmove
strchr
wcslen
strncmp
__CxxFrameHandler
atoi
_strlwr
strncpy
_findfirst
_findclose
_findnext
ws2_32
gethostbyname
WSAStartup
WSACleanup
inet_addr
Sections
.data Size: 53KB - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 116KB - Virtual size: 184KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE