Static task
static1
Behavioral task
behavioral1
Sample
f5495a9345b5e69fed43e0c10c2a9c52_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f5495a9345b5e69fed43e0c10c2a9c52_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f5495a9345b5e69fed43e0c10c2a9c52_JaffaCakes118
-
Size
496KB
-
MD5
f5495a9345b5e69fed43e0c10c2a9c52
-
SHA1
25fb8f9dd8ea8fe3bd6fd87d28196f8c06385597
-
SHA256
a68aed48ece45aec12e97373aed334d9dbe6d2b53e7c355324303be80acb4f2e
-
SHA512
5620c2dbdeea497b63ceaa498cf3dc836a655d7b1a1180d8c0fc2a2ca935b7254136afd8602505242eba053e59efcd146ba4f7d8832c31b00dc8390e30c15939
-
SSDEEP
12288:IWEYQIwH4cEUvuXFV4e/CfTTNGkSE627RbbzVJI:AH4HUY+e6nPhX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f5495a9345b5e69fed43e0c10c2a9c52_JaffaCakes118
Files
-
f5495a9345b5e69fed43e0c10c2a9c52_JaffaCakes118.exe windows:4 windows x86 arch:x86
2ea904a5ad674ba3e624463fa16fc329
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FreeEnvironmentStringsA
GetTimeFormatA
GetThreadPriority
SetEndOfFile
GetStartupInfoA
GlobalCompact
HeapAlloc
LoadLibraryA
UnhandledExceptionFilter
MultiByteToWideChar
WideCharToMultiByte
ExitThread
ExpandEnvironmentStringsA
GetCPInfo
TlsGetValue
TlsSetValue
FreeEnvironmentStringsW
GetStringTypeA
GetStringTypeW
SetLocaleInfoW
TlsAlloc
GetDateFormatA
GetSystemInfo
GetEnvironmentStrings
InterlockedExchangeAdd
GetVersionExA
VirtualProtect
GetStdHandle
GetProcAddress
CompareStringA
GetStartupInfoW
HeapFree
EnumResourceLanguagesA
GetCurrentThread
EnumDateFormatsW
HeapCreate
VirtualQuery
LeaveCriticalSection
HeapDestroy
SetHandleCount
GetACP
HeapSize
VirtualFree
GetOEMCP
HeapReAlloc
LCMapStringW
ExitProcess
GetEnvironmentStringsW
CompareStringW
VirtualAlloc
TerminateProcess
QueryPerformanceCounter
GetCurrentProcess
IsValidCodePage
GetModuleHandleA
GetLocaleInfoA
InitializeCriticalSection
IsBadWritePtr
GetCurrentThreadId
SetLastError
WriteFile
GetCommandLineW
GetLocaleInfoW
GetCurrentProcessId
GetModuleFileNameA
IsValidLocale
GetCommandLineA
SetVolumeLabelW
GetTickCount
GetUserDefaultLCID
EnumSystemLocalesA
GetLastError
TlsFree
SetEnvironmentVariableA
RtlUnwind
GetFileType
GetSystemTimeAsFileTime
InterlockedExchange
LCMapStringA
EnterCriticalSection
DeleteCriticalSection
GetModuleFileNameW
FoldStringW
GetTimeZoneInformation
wininet
InternetGetLastResponseInfoA
InternetDial
InternetSetDialStateA
InternetQueryOptionA
InternetConfirmZoneCrossingA
FindFirstUrlCacheEntryA
InternetSetOptionA
InternetGetConnectedState
FtpRemoveDirectoryW
FtpOpenFileA
CreateUrlCacheEntryW
FtpGetFileA
RetrieveUrlCacheEntryStreamA
InternetFortezzaCommand
InternetGetConnectedStateExW
InternetOpenUrlA
FtpSetCurrentDirectoryW
FindCloseUrlCache
FindFirstUrlCacheEntryExW
ShowClientAuthCerts
InternetWriteFileExW
CommitUrlCacheEntryA
GetUrlCacheHeaderData
advapi32
LogonUserA
StartServiceA
LookupSecurityDescriptorPartsA
RegDeleteKeyW
CryptGenRandom
CryptExportKey
CryptContextAddRef
CryptDestroyKey
RegSetValueW
RegSetValueExA
RegRestoreKeyA
RegCreateKeyA
RegEnumKeyExW
RegLoadKeyW
CryptEnumProviderTypesW
CreateServiceW
RegQueryMultipleValuesW
RegCreateKeyExA
RegOpenKeyExW
CryptSetProviderExA
RevertToSelf
InitiateSystemShutdownW
CryptDeriveKey
ReportEventA
gdi32
SetRectRgn
CreateRectRgn
BeginPath
GetWindowOrgEx
DPtoLP
GetGlyphOutlineW
GetAspectRatioFilterEx
GetLogColorSpaceW
RectInRegion
SelectPalette
CreateHalftonePalette
CreateHatchBrush
GetEnhMetaFileBits
SetICMProfileA
Sections
.text Size: 206KB - Virtual size: 206KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 276KB - Virtual size: 276KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ