AddTask
Static task
static1
Behavioral task
behavioral1
Sample
f7b1a17dd42eb2f59897423cd389f3aa_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f7b1a17dd42eb2f59897423cd389f3aa_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f7b1a17dd42eb2f59897423cd389f3aa_JaffaCakes118
-
Size
239KB
-
MD5
f7b1a17dd42eb2f59897423cd389f3aa
-
SHA1
b3090a912b2660a6ca47faddbf87aff49c900d98
-
SHA256
686b49bc8b9422382ea219f1f395eada5dbb91451129708c995e88a09f4f3465
-
SHA512
ea974ba77c94c25bd188bc77704e24833ea74f3c55b9ae4c96658fc5eec0bacaa805d927eb45204a396aa1ff550a63dd950e47616ff537d64ae4e55860627789
-
SSDEEP
6144:zoKUeGb+xYOeWQKNXU3H0t3yIFoSZyTBcF:BUeq+xFjQKNXa+rZyT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f7b1a17dd42eb2f59897423cd389f3aa_JaffaCakes118
Files
-
f7b1a17dd42eb2f59897423cd389f3aa_JaffaCakes118.exe windows:5 windows x86 arch:x86
34267238504f362d5bcee7e611712878
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
OpenEventA
CloseHandle
CreateProcessA
GetTickCount
CreateDirectoryA
GetTempPathA
WritePrivateProfileStringA
GetPrivateProfileStringA
CreateThread
Sleep
GetModuleFileNameA
GetFileTime
DosDateTimeToFileTime
SetEndOfFile
SetStdHandle
WriteConsoleW
FreeLibrary
DeleteFileA
LoadLibraryW
GetStringTypeW
FlushFileBuffers
GetConsoleMode
GetConsoleCP
LCMapStringW
QueryPerformanceCounter
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GlobalAlloc
GlobalFree
GetLastError
GetCurrentDirectoryA
SetCurrentDirectoryA
CreateFileA
WriteFile
CreateToolhelp32Snapshot
Process32First
Process32Next
TerminateProcess
Module32First
Module32Next
GetProcAddress
GetModuleHandleA
ReadFile
WideCharToMultiByte
VirtualQuery
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetPrivateProfileIntA
GetLocalTime
GetCurrentProcessId
OutputDebugStringA
MultiByteToWideChar
GetCurrentProcess
GetVersionExA
CreateFileW
GetFileInformationByHandle
SetFilePointer
CreateEventA
WaitForSingleObject
SetEvent
GetACP
FormatMessageA
LocalFileTimeToFileTime
GetFileAttributesA
SetFileTime
SetLastError
HeapAlloc
GetProcessHeap
HeapFree
RaiseException
RtlUnwind
EncodePointer
DecodePointer
GetCommandLineA
HeapSetInformation
GetStartupInfoW
GetSystemTimeAsFileTime
GetModuleHandleW
ExitProcess
HeapReAlloc
IsProcessorFeaturePresent
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
InterlockedDecrement
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapSize
HeapCreate
GetStdHandle
GetModuleFileNameW
GetCPInfo
GetOEMCP
IsValidCodePage
user32
LoadStringA
wsprintfA
shell32
SHGetSpecialFolderPathA
ws2_32
send
accept
listen
ioctlsocket
recv
bind
setsockopt
socket
ntohs
gethostname
recvfrom
__WSAFDIsSet
select
gethostbyname
sendto
htons
WSACleanup
closesocket
WSAStartup
inet_ntoa
inet_addr
htonl
ntohl
getpeername
gethostbyaddr
connect
iphlpapi
GetAdaptersInfo
wininet
HttpQueryInfoA
InternetSetStatusCallback
InternetOpenA
InternetReadFile
InternetOpenUrlA
InternetCloseHandle
advapi32
RegOpenKeyExA
RegCloseKey
RegQueryValueExA
Exports
Exports
Sections
.text Size: 163KB - Virtual size: 162KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 55KB - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ