Static task
static1
Behavioral task
behavioral1
Sample
f76bec0b84ed36aa4591fc39a98f46a7_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f76bec0b84ed36aa4591fc39a98f46a7_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f76bec0b84ed36aa4591fc39a98f46a7_JaffaCakes118
-
Size
199KB
-
MD5
f76bec0b84ed36aa4591fc39a98f46a7
-
SHA1
be2c42cf2076fed1e7d184965d7ad7467f7b166b
-
SHA256
77f88e03cd8c49e462fea3513d68c47b9bb81f5c181b8d1d75e73c08cef97e04
-
SHA512
5caffa3306d0a3b2ad9210f23e96cc32e15bea9582e675039ae3b82fde841ad782f163d061dfb53db758398419944ea936c22a79a8d9775c8ab0412697a88336
-
SSDEEP
6144:/kmms5wfkT4L1eAg3ocvkRZVhaoJjvjjfKoFfBw2Odc9h:/kmms50kT4L1Zg3ocQVgsLjfnF5wn6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f76bec0b84ed36aa4591fc39a98f46a7_JaffaCakes118
Files
-
f76bec0b84ed36aa4591fc39a98f46a7_JaffaCakes118.exe windows:4 windows x86 arch:x86
e3497385da1693701b4b1f6a7c6d890c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LCMapStringA
GetStdHandle
GetStartupInfoA
GetLastError
RtlUnwind
FreeEnvironmentStringsW
GetFileType
GetCurrentProcess
UnhandledExceptionFilter
VirtualAlloc
GetStringTypeA
SetHandleCount
HeapReAlloc
TlsAlloc
FreeEnvironmentStringsA
SetLastError
HeapDestroy
InterlockedExchange
GetModuleFileNameA
IsBadWritePtr
GetModuleHandleA
ExitProcess
LeaveCriticalSection
WriteFile
DeleteCriticalSection
LoadLibraryA
GetTickCount
GetSystemTimeAsFileTime
VirtualFree
HeapCreate
GetCPInfo
QueryPerformanceCounter
EnterCriticalSection
TlsSetValue
GetCurrentThread
VirtualQuery
GetCurrentThreadId
GetVersion
HeapAlloc
TlsGetValue
HeapFree
LocalCompact
TerminateProcess
GetCurrentProcessId
GetEnvironmentStringsW
LCMapStringW
WideCharToMultiByte
CopyFileA
GetCommandLineA
GetStringTypeW
MultiByteToWideChar
GetEnvironmentStrings
InitializeCriticalSection
GetProcAddress
TlsFree
GetACP
GetOEMCP
shell32
ExtractIconExW
SHGetSpecialFolderPathA
RealShellExecuteA
SHEmptyRecycleBinA
RealShellExecuteExA
SHGetDiskFreeSpaceA
SHGetSpecialFolderPathW
FindExecutableA
DoEnvironmentSubstW
ExtractAssociatedIconExA
DoEnvironmentSubstA
SheSetCurDrive
SHLoadInProc
ExtractAssociatedIconExW
FindExecutableW
user32
DialogBoxIndirectParamA
CharLowerW
DdeAddData
ShowScrollBar
GetCaretPos
CreateWindowExW
RealChildWindowFromPoint
MessageBoxA
SendDlgItemMessageA
CharPrevA
GetClipboardOwner
GetSystemMetrics
GetActiveWindow
DrawMenuBar
VkKeyScanW
LoadCursorW
SetForegroundWindow
RegisterWindowMessageW
IsCharAlphaA
TileChildWindows
Sections
.text Size: 87KB - Virtual size: 87KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 105KB - Virtual size: 125KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ