Static task
static1
Behavioral task
behavioral1
Sample
f7cfbbde4b42eb213d98e956af12fb65_JaffaCakes118.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
f7cfbbde4b42eb213d98e956af12fb65_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f7cfbbde4b42eb213d98e956af12fb65_JaffaCakes118
-
Size
413KB
-
MD5
f7cfbbde4b42eb213d98e956af12fb65
-
SHA1
2a2181362e9b78013bc9209e5e04b4804bedbba7
-
SHA256
ba614ff182d49edf8b91792b370ceb5680748773922e709882b5ede6047924c1
-
SHA512
5cff3a75bbf909ad8917c2b644628c43b9823460173c1b36bfca7e6ad71fcac22a92a3cb595d8e458117d70a20217dedca3fdf135ea018c89cc1d1edb318df5a
-
SSDEEP
12288:aNLimHBOuZzqHsk5yrZviGAu1xSd09okxGUR0K+zq:iJsizq15yrZDAu1xSd9kwFK+z
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f7cfbbde4b42eb213d98e956af12fb65_JaffaCakes118
Files
-
f7cfbbde4b42eb213d98e956af12fb65_JaffaCakes118.exe windows:4 windows x86 arch:x86
e7aa3660f36eb4fb813cb1732e2a1e4a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
gdi32
CreateHatchBrush
ArcTo
UpdateICMRegKeyW
PlayEnhMetaFileRecord
Chord
LPtoDP
GetKerningPairs
GetTextFaceA
PathToRegion
GetRasterizerCaps
GdiSetBatchLimit
TextOutA
GetTextExtentExPointW
GetWinMetaFileBits
CreateCompatibleBitmap
CreateDIBSection
CreateEnhMetaFileW
CreateICA
Pie
DeleteColorSpace
OffsetViewportOrgEx
GetCurrentObject
advapi32
RegOpenKeyExW
AbortSystemShutdownW
RegEnumKeyExW
GetUserNameA
CryptEnumProvidersW
CryptGetHashParam
RegSetValueA
LogonUserA
ReportEventW
RegEnumKeyA
DuplicateTokenEx
CryptSetProviderExA
LookupPrivilegeDisplayNameA
CryptGetDefaultProviderW
LookupPrivilegeNameW
CryptExportKey
RegSetValueExA
CreateServiceA
RegSetValueExW
CryptSetKeyParam
shell32
SHChangeNotify
RealShellExecuteW
ShellAboutA
DragAcceptFiles
SheGetDirA
kernel32
GetCPInfo
HeapDestroy
ReadConsoleInputW
SetEnvironmentVariableA
FreeLibrary
HeapCreate
InterlockedExchange
IsDebuggerPresent
HeapAlloc
IsValidLocale
TlsFree
GetStdHandle
GetCurrentProcessId
GetDiskFreeSpaceExA
GetCurrentThreadId
TerminateProcess
GetVolumeInformationW
FreeEnvironmentStringsW
SetHandleCount
GetPrivateProfileSectionW
GetSystemTimeAsFileTime
QueryPerformanceCounter
CompareStringW
SetUnhandledExceptionFilter
InitializeCriticalSection
LCMapStringW
GetDateFormatA
GetCurrentThread
GetUserDefaultLCID
GetCurrentProcess
GetOEMCP
GetStartupInfoA
VirtualFree
GetTimeZoneInformation
SetConsoleCtrlHandler
WideCharToMultiByte
GetModuleFileNameA
UnhandledExceptionFilter
EnumSystemLocalesA
GetEnvironmentStrings
WriteFile
InterlockedDecrement
EnterCriticalSection
HeapReAlloc
VirtualAlloc
IsValidCodePage
GetStartupInfoW
CompareStringA
GetProcessHeap
GlobalGetAtomNameA
GetModuleHandleA
GetLocaleInfoW
HeapFree
FreeEnvironmentStringsA
GetProcAddress
MultiByteToWideChar
SetLastError
InterlockedIncrement
GetACP
GetModuleFileNameW
GetStringTypeA
LeaveCriticalSection
ReadConsoleInputA
GetVersionExA
TlsSetValue
GetFileType
GetTimeFormatA
GetCommandLineA
RtlUnwind
OutputDebugStringW
ExitProcess
LoadLibraryA
FlushFileBuffers
VirtualQuery
HeapSize
ReadConsoleOutputW
GetStringTypeW
GetEnvironmentStringsW
GetTickCount
GetLastError
LCMapStringA
DeleteCriticalSection
GetCommandLineW
TlsGetValue
GetLocaleInfoA
Sleep
TlsAlloc
comdlg32
FindTextA
GetFileTitleW
Sections
.text Size: 121KB - Virtual size: 120KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 9KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 279KB - Virtual size: 278KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ