Static task
static1
Behavioral task
behavioral1
Sample
f59ab3623029421adb713272027c5d7d_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f59ab3623029421adb713272027c5d7d_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f59ab3623029421adb713272027c5d7d_JaffaCakes118
-
Size
45KB
-
MD5
f59ab3623029421adb713272027c5d7d
-
SHA1
11604a2a478bf7ae59b33565a2c3a28a50781328
-
SHA256
8b1acd1dcd5c18d3570bcca0d952bb334b176f59b5d5b366e547fcac9e660796
-
SHA512
a3d378ae4d8d7e0842dab95d344d9ac3ca5cdd6309b8b30d5c83ea2fb8f2cdbae678a329180e1b48bf9ad3caa540e7b599a0118ce28eee5713f2eb8b5bdfb6fe
-
SSDEEP
384:cSqsv5l9CfV0v0CByBlGyGahxbV+N84yhQ0/tvYJL1WVUYJLu1vPbCzP:cSflw0vLUll8JD0/t+L1WDLWHbCT
Malware Config
Signatures
Files
-
f59ab3623029421adb713272027c5d7d_JaffaCakes118.exe windows:4 windows x86 arch:x86
28b8c00257f00fa4e8ef90f182042436
Code Sign
3d:01:cb:0f:89:1a:76:9c:4e:56:ef:8a:74:7e:ad:93Certificate
IssuerCN=VeriSign Class 3 Code Signing 2004 CANot Before07/06/2011, 03:28Not After31/12/2039, 23:59SubjectCN=Tencent Technology(Shenzhen) Company Limited38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate
IssuerCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USNot Before15/06/2007, 00:00Not After14/06/2012, 23:59SubjectCN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before04/12/2003, 00:00Not After03/12/2013, 23:59SubjectCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
69:cb:10:a0:81:68:67:d3:ed:0e:9d:52:1f:aa:28:48:e5:7b:0a:aeSigner
Actual PE Digest69:cb:10:a0:81:68:67:d3:ed:0e:9d:52:1f:aa:28:48:e5:7b:0a:aeDigest Algorithmsha1PE Digest MatchesfalseHeaders
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Process32Next
GetProcAddress
LoadLibraryA
ExitProcess
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
WriteFile
GetCPInfo
GetACP
GetOEMCP
HeapAlloc
VirtualAlloc
HeapReAlloc
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
Sections
.text Size: 28KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE