Static task
static1
Behavioral task
behavioral1
Sample
f7b7f1704e593c364edf8b505bef5be3_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f7b7f1704e593c364edf8b505bef5be3_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f7b7f1704e593c364edf8b505bef5be3_JaffaCakes118
-
Size
294KB
-
MD5
f7b7f1704e593c364edf8b505bef5be3
-
SHA1
509b9fa9cf75a76e75febef38e0f25340b70bd3c
-
SHA256
56d92be368e1ce4867c7ac8a214a203fa9530a1f2bfbce904bbc59e9399e0999
-
SHA512
f01bcdcd68488d8264e371cc2f140276747cfdcce19d429fcf6c0cbe6a5bf4dc325a0ac401c53bcf75bcb604cd4209bc46ec88eddcf93542fb74ac497de35a59
-
SSDEEP
6144:3OHgz46ogwWQIBfgiDOppppppppppppppppppppppppppppppppppppppppppppR:3mgz1uiOpppppppppppppppppppppppv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f7b7f1704e593c364edf8b505bef5be3_JaffaCakes118
Files
-
f7b7f1704e593c364edf8b505bef5be3_JaffaCakes118.exe windows:5 windows x86 arch:x86
5c023189c53918ce7c3f7b3203cc6844
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
userenv
GetProfilesDirectoryA
kernel32
GetModuleHandleA
GetComputerNameA
InterlockedIncrement
InterlockedDecrement
GetVolumeInformationA
GetCurrentProcessId
ExpandEnvironmentStringsA
OpenProcess
GlobalAlloc
GlobalFree
LocalFree
MultiByteToWideChar
ExitProcess
CreateMutexA
GetACP
GetCPInfo
RtlUnwind
FlushFileBuffers
lstrcpynA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
InitializeCriticalSectionAndSpinCount
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
GetConsoleMode
GetConsoleCP
HeapReAlloc
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
QueryPerformanceCounter
VirtualFree
lstrcpyA
DeleteFileA
GetTempPathA
CloseHandle
GetVersionExA
FindNextFileA
GetModuleFileNameA
LoadLibraryA
GetPrivateProfileStringA
FindClose
RemoveDirectoryA
GetLastError
GetProcAddress
FindFirstFileA
lstrcatA
ReadFile
GetFileAttributesA
Sleep
WriteFile
GetProcessHeap
GetTickCount
HeapFree
RaiseException
GetCurrentProcess
HeapAlloc
FreeLibrary
SetEndOfFile
MoveFileExA
lstrlenA
SetFilePointer
lstrcmpA
GetFileSize
CreateFileA
GetOEMCP
HeapCreate
DeleteCriticalSection
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStdHandle
HeapSize
LCMapStringW
GetStartupInfoA
GetCommandLineA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetModuleHandleW
WideCharToMultiByte
LCMapStringA
GetCurrentThreadId
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
user32
GetShellWindow
ExitWindowsEx
SendMessageA
FindWindowA
MessageBoxA
GetWindowThreadProcessId
EndPaint
DestroyWindow
GetMessageA
GetWindowRect
RegisterClassExA
PostQuitMessage
FillRect
SetForegroundWindow
LoadBitmapA
LoadIconA
SetFocus
BeginPaint
TranslateMessage
InvalidateRect
GetWindowLongA
CreateWindowExA
GetDlgItem
DefWindowProcA
GetSysColor
SetWindowPos
ShowWindow
DispatchMessageA
AdjustWindowRectEx
SystemParametersInfoA
SetWindowTextA
UpdateWindow
LoadCursorA
GetUserObjectSecurity
gdi32
GetTextExtentPoint32A
DeleteDC
CreateFontA
SetBkMode
DeleteObject
SelectObject
CreateCompatibleDC
GetObjectA
GetStockObject
CreateSolidBrush
TextOutA
BitBlt
advapi32
AdjustTokenPrivileges
IsValidSid
GetSecurityDescriptorOwner
LookupAccountSidA
GetTokenInformation
ConvertSidToStringSidA
RegCloseKey
RegOpenKeyA
GetUserNameA
RegDeleteValueA
RegOpenKeyExA
LookupPrivilegeValueA
RegCreateKeyA
RegDeleteKeyA
RegQueryValueExA
RegSetValueExA
OpenProcessToken
shell32
ShellExecuteA
ord680
SHGetFolderPathA
ShellExecuteExA
SHFileOperationA
ole32
CoInitialize
CoCreateInstance
CoUninitialize
oleaut32
VariantClear
shlwapi
wnsprintfA
SHDeleteKeyA
StrNCatA
StrStrIA
StrStrA
PathFileExistsA
Sections
.text Size: 71KB - Virtual size: 70KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 191KB - Virtual size: 191KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ