Static task
static1
Behavioral task
behavioral1
Sample
f64c94abd11f81827090942a05d65784_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
f64c94abd11f81827090942a05d65784_JaffaCakes118
-
Size
158KB
-
MD5
f64c94abd11f81827090942a05d65784
-
SHA1
cc6ee6502fea40b4d353ffc59087a83915063230
-
SHA256
3dcaf6661ac5b470ddc592202f5e3590b4c1c49352148045b1273d60293b46f2
-
SHA512
638d5e046fdd22fad43b1617b1647830929ea85122c18f2aaa604bba70418966a49ac48e03802b841a981942521e40eb6d77b27d68046722d8b1b826b4a2a535
-
SSDEEP
3072:8Bs5q0AD1dMc5HwbMvDZT2SPuO1QGQiHQU9vJe2iR4Obr:8BSqd1Kc+bQDZTDuO1QmJ1iR4Ob
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f64c94abd11f81827090942a05d65784_JaffaCakes118
Files
-
f64c94abd11f81827090942a05d65784_JaffaCakes118.exe windows:5 windows x64 arch:x64
57f833e651548ac7e24da40f6a91753a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetLastError
GetProcAddress
VirtualAllocEx
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
CloseHandle
WriteProcessMemory
CreateFileA
FreeResource
FindResourceW
LoadResource
SystemTimeToFileTime
GetCurrentProcess
GetVersionExW
GetWindowsDirectoryA
WriteFile
GetSystemWow64DirectoryA
SizeofResource
GetSystemDirectoryA
SetFileAttributesA
LockResource
GetModuleFileNameA
OutputDebugStringA
GetTempPathA
LocalFileTimeToFileTime
GetTickCount
GetSystemTimeAsFileTime
Sleep
LoadLibraryW
VirtualFreeEx
GetSystemDirectoryW
OpenProcess
CreateRemoteThread
GetModuleHandleW
WaitForSingleObject
FreeLibrary
SetFileTime
QueryPerformanceCounter
GetCurrentProcessId
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetCurrentThreadId
user32
KillTimer
advapi32
AdjustTokenPrivileges
RegOpenKeyExW
LookupPrivilegeValueW
RegCreateKeyExA
OpenProcessToken
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
shell32
ShellExecuteA
msvcr90
strrchr
fclose
_amsg_exit
__wgetmainargs
__C_specific_handler
_XcptFilter
_exit
_cexit
exit
__winitenv
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_commode
_fmode
_encode_pointer
__set_app_type
__crt_debugger_hook
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
fopen
remove
_errno
malloc
free
sprintf
_wcsicmp
memcpy
memset
fwrite
Sections
.text Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1024B - Virtual size: 660B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 141KB - Virtual size: 141KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 60B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ