Static task
static1
Behavioral task
behavioral1
Sample
fb40116d81f7836a79e81cccebd8e0cd_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fb40116d81f7836a79e81cccebd8e0cd_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
fb40116d81f7836a79e81cccebd8e0cd_JaffaCakes118
-
Size
84KB
-
MD5
fb40116d81f7836a79e81cccebd8e0cd
-
SHA1
3893c433bb5698889d47bd0f27f86f9d213a50a4
-
SHA256
dd81fa1e07c045cfc261b1a279907c0ea43f017c6d856d8a3d47202337f42b08
-
SHA512
813abdf21dbcea27612bc2ac8d0240c10ad42a1bce33ac8f80efe19916beb51c86b120ddff4154f3c713673d0bd54f2dcd43027f03e74ffa41b00eb8a4a4871f
-
SSDEEP
1536:MebLcQw6NfuUEf2NcahMafLCeFUeBFNe4fqggiPn:MQXxulf2NxMcLCeFUePNe4yg
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fb40116d81f7836a79e81cccebd8e0cd_JaffaCakes118
Files
-
fb40116d81f7836a79e81cccebd8e0cd_JaffaCakes118.exe windows:4 windows x86 arch:x86
2c83682b13d8845bed0571e72db392d5
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
OpenEventA
SetErrorMode
CreateThread
GetTickCount
GetStartupInfoA
GetModuleHandleA
ReleaseMutex
GetVersionExA
GetProcessHeap
HeapAlloc
HeapFree
DeleteFileA
MoveFileA
TerminateThread
OpenProcess
WriteProcessMemory
InitializeCriticalSection
CreateRemoteThread
GetCurrentProcess
CreateFileA
SetFilePointer
WriteFile
LocalSize
LocalFree
GetWindowsDirectoryA
GetFileAttributesA
FreeLibrary
lstrlenA
LocalReAlloc
LocalAlloc
CancelIo
SetEvent
ResetEvent
WaitForSingleObject
CloseHandle
CreateEventA
LoadLibraryA
GetProcAddress
EnterCriticalSection
LeaveCriticalSection
VirtualFree
DeleteCriticalSection
Sleep
OutputDebugStringA
user32
OpenWindowStationA
GetProcessWindowStation
ExitWindowsEx
GetWindowThreadProcessId
IsWindowVisible
GetWindowTextA
CloseDesktop
SetThreadDesktop
OpenInputDesktop
GetUserObjectInformationA
GetThreadDesktop
PostMessageA
OpenDesktopA
wsprintfA
SetProcessWindowStation
advapi32
RegEnumKeyExA
InitializeAcl
AddAccessAllowedAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegSetKeySecurity
FreeSid
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyA
SetEntriesInAclA
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetNamedSecurityInfoA
RegCreateKeyA
RegSetValueExA
RegCloseKey
OpenSCManagerA
OpenServiceA
QueryServiceStatus
ControlService
DeleteService
CloseServiceHandle
AllocateAndInitializeSid
RegOpenKeyExA
RegEnumValueA
RegQueryValueExA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
CreateProcessAsUserA
SetTokenInformation
DuplicateTokenEx
LookupAccountSidA
GetTokenInformation
GetLengthSid
shell32
SHGetSpecialFolderPathA
shlwapi
SHDeleteKeyA
msvcrt
exit
_strnicmp
_strrev
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
_strupr
_XcptFilter
_exit
??3@YAXPAX@Z
memcpy
__CxxFrameHandler
_CxxThrowException
memmove
ceil
_ftol
strlen
strstr
memset
??2@YAPAXI@Z
strcpy
malloc
strcat
_except_handler3
strncpy
strrchr
strtok
strncat
strchr
atoi
_beginthreadex
calloc
free
??1type_info@@UAE@XZ
ws2_32
send
getsockname
gethostname
closesocket
recv
htons
connect
socket
WSAStartup
WSACleanup
WSAIoctl
setsockopt
gethostbyname
select
ntohs
wininet
InternetOpenA
InternetReadFile
InternetCloseHandle
InternetOpenUrlA
wtsapi32
WTSFreeMemory
WTSQueryUserToken
WTSQuerySessionInformationA
userenv
CreateEnvironmentBlock
Sections
.text Size: 52KB - Virtual size: 51KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ