Static task
static1
Behavioral task
behavioral1
Sample
f88ddd2b2fae2d760ecb076bc4cf6495_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f88ddd2b2fae2d760ecb076bc4cf6495_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f88ddd2b2fae2d760ecb076bc4cf6495_JaffaCakes118
-
Size
467KB
-
MD5
f88ddd2b2fae2d760ecb076bc4cf6495
-
SHA1
095f866eb74ef6021a473a978326ed9874cca753
-
SHA256
80166f0df067840e37c0a49460047ac8281b4d721082557914ad73a973154ae9
-
SHA512
4bcb05dba31f8da8e912796e0103dd8f86543e209cf54da49c19b50b71ac4c175996bf4ba7b933860b7920e79f5c1602165edcf4f10e53d5496b666bb0bd8a84
-
SSDEEP
12288:+dQrPn4Y17GjuloLsduptlt9voy/2jjKFi+u1C6yKdal:qQrRsju8sY793FI1C6yKd
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f88ddd2b2fae2d760ecb076bc4cf6495_JaffaCakes118
Files
-
f88ddd2b2fae2d760ecb076bc4cf6495_JaffaCakes118.exe windows:5 windows x86 arch:x86
16f918727956e3290e9ef449cc9402d9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegCloseKey
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegQueryValueExA
RegOpenKeyExA
kernel32
InterlockedDecrement
CreateThread
GetCurrentThreadId
lstrlenW
GetModuleFileNameW
HeapReAlloc
WriteFile
CreateFileW
lstrlenA
SetEvent
LocalFree
GetOverlappedResult
ReadFile
LocalAlloc
GetFileSizeEx
MulDiv
FormatMessageW
WaitForSingleObject
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoA
GetCommandLineA
GetVersionExA
ExitProcess
GetProcAddress
LoadLibraryExA
HeapAlloc
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapDestroy
HeapCreate
VirtualFree
LoadLibraryA
GetACP
GetOEMCP
GetCPInfo
VirtualAlloc
RtlUnwind
InterlockedExchange
VirtualQuery
SetFilePointer
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
SetStdHandle
VirtualProtect
GetSystemInfo
GetLocaleInfoA
FlushFileBuffers
InterlockedIncrement
WaitForMultipleObjects
GetLastError
GetModuleHandleA
ResetEvent
HeapFree
GetProcessHeap
CreateEventW
GetStdHandle
CloseHandle
gdi32
GetObjectW
GetDeviceCaps
CreateFontIndirectW
DeleteObject
user32
TranslateMessage
GetMessageW
LoadImageW
GetDC
ReleaseDC
MessageBoxW
SetWindowTextW
ShowWindow
SetDlgItemTextW
SetFocus
SendMessageW
PostThreadMessageW
GetDlgItemTextW
GetDlgItem
GetWindowTextLengthW
EnableWindow
GetWindowLongW
SetWindowLongW
SendDlgItemMessageW
GetParent
PostMessageW
LoadStringW
KillTimer
DispatchMessageW
SetTimer
PostQuitMessage
shell32
SHGetFolderPathW
SHBindToParent
SHGetSpecialFolderPathW
ord155
SHGetPathFromIDListW
SHBrowseForFolderW
ShellExecuteW
ord258
SHSetLocalizedName
comdlg32
GetOpenFileNameW
shlwapi
StrFormatByteSizeW
StrRetToBufW
SHSetValueW
PathFindFileNameW
PathAddExtensionW
PathAppendW
PathRemoveFileSpecW
StrStrIA
PathCombineW
mswsock
AcceptEx
ole32
CoInitialize
CoMarshalInterThreadInterfaceInStream
CoRegisterClassObject
CoRevokeClassObject
CoInitializeEx
CoGetInterfaceAndReleaseStream
CoCreateInstance
CoUninitialize
irprops.cpl
BluetoothAuthenticateDevice
BluetoothEnableDiscovery
BluetoothSelectDevices
BluetoothSelectDevicesFree
BluetoothFindFirstRadio
BluetoothFindRadioClose
BluetoothGetDeviceInfo
Sections
.text Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 148KB - Virtual size: 148KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 143KB - Virtual size: 143KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 143KB - Virtual size: 143KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 412B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ