Static task
static1
Behavioral task
behavioral1
Sample
f950eed72b6b3b4ff2dc164322b1ed05_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f950eed72b6b3b4ff2dc164322b1ed05_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f950eed72b6b3b4ff2dc164322b1ed05_JaffaCakes118
-
Size
483KB
-
MD5
f950eed72b6b3b4ff2dc164322b1ed05
-
SHA1
515c36ed8b49895b0f2a663ed800af83c0f2cb12
-
SHA256
586b3ee51b3c0347e1f8450b19051ee8996781b7abeb93619b12886633f66944
-
SHA512
ae5fe43cd127491b41cc687d8627730d2401f5a12fd56e1a27a548493338776981c7ea7ec899e764ac6810aa5e9f8f38f2d43b30f5d9b9965431967095548826
-
SSDEEP
6144:i/aRqcvFMblUnGGx+saU2jX1EJg0POLA71OSfzbb+vtuipRs+dM0MtcHtRS99Qlh:yRQJBMAIof6vsipqVCfS9Gu9JCCI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f950eed72b6b3b4ff2dc164322b1ed05_JaffaCakes118
Files
-
f950eed72b6b3b4ff2dc164322b1ed05_JaffaCakes118.exe windows:4 windows x86 arch:x86
e419aa00aa8a482709ae510958ba8e97
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
shell32
SHUpdateRecycleBinIcon
SHChangeNotify
SHGetPathFromIDList
SHGetMalloc
SHGetNewLinkInfo
SHGetSpecialFolderPathA
DragQueryFileAorW
RealShellExecuteW
SHGetSpecialFolderPathW
SHGetFileInfoA
SHInvokePrinterCommandA
ExtractIconEx
SheChangeDirA
ShellExecuteExA
ExtractAssociatedIconA
SHFileOperation
ExtractIconExW
ExtractIconExA
SHFileOperationA
wininet
InternetSetOptionW
UnlockUrlCacheEntryFile
HttpSendRequestExA
FtpGetFileA
FtpOpenFileW
FtpGetCurrentDirectoryA
InternetGetCookieW
FtpDeleteFileA
InternetCreateUrlA
UnlockUrlCacheEntryFileA
GopherOpenFileW
InternetTimeFromSystemTimeA
FindFirstUrlCacheEntryA
IsHostInProxyBypassList
FindFirstUrlCacheEntryW
CommitUrlCacheEntryA
SetUrlCacheGroupAttributeW
advapi32
CryptSignHashW
RegDeleteValueA
CryptGetUserKey
CryptExportKey
RegNotifyChangeKeyValue
CryptSignHashA
RegQueryMultipleValuesW
CryptSetHashParam
RegEnumKeyA
CryptVerifySignatureA
user32
GetCursor
DrawFrameControl
NotifyWinEvent
AdjustWindowRect
CreateDesktopA
ChangeMenuA
CharLowerA
kernel32
GetSystemTime
CreateWaitableTimerW
GetTimeZoneInformation
TlsSetValue
GetACP
InterlockedExchange
GetVersionExA
GetModuleFileNameA
GetCurrentThreadId
TlsGetValue
FreeResource
FreeEnvironmentStringsW
GetProcAddress
UnhandledExceptionFilter
InterlockedIncrement
GlobalFlags
InterlockedDecrement
WriteFile
GetEnvironmentStrings
HeapSize
FreeEnvironmentStringsA
SetEnvironmentVariableA
HeapAlloc
SetConsoleMode
GlobalUnfix
EnumSystemLocalesA
GetLastError
InitializeCriticalSection
IsValidCodePage
IsDebuggerPresent
GetCurrentThread
GetTimeFormatW
OutputDebugStringA
GetLocaleInfoW
HeapReAlloc
EnterCriticalSection
SetUnhandledExceptionFilter
GetCommandLineA
CreateDirectoryExA
SetHandleCount
MultiByteToWideChar
GetFileType
ReadConsoleInputW
HeapDestroy
GetSystemTimeAsFileTime
CompareFileTime
GetDateFormatA
HeapFree
GetTickCount
VirtualFree
OpenFileMappingA
WritePrivateProfileSectionA
GetVolumeInformationA
GetComputerNameA
ExitProcess
TlsAlloc
GetEnvironmentStringsW
GetUserDefaultLCID
SetConsoleCP
GetStringTypeA
QueryPerformanceCounter
GetStdHandle
GetLocaleInfoA
LocalReAlloc
ResetEvent
GetOEMCP
LoadLibraryA
HeapCreate
GetModuleHandleA
SetConsoleCtrlHandler
RtlUnwind
LCMapStringW
TlsFree
SetLastError
GetCommandLineW
DeleteCriticalSection
GetCurrentProcess
IsValidLocale
GetStringTypeW
CompareStringA
GetProfileIntW
GetStartupInfoA
MapViewOfFileEx
GetStartupInfoW
CompareStringW
Sleep
GetWindowsDirectoryA
GetModuleFileNameW
LoadResource
GetCPInfo
GetCurrentProcessId
VirtualQuery
LCMapStringA
TerminateProcess
WriteProfileStringW
WideCharToMultiByte
WaitForSingleObject
VirtualAlloc
GetTimeFormatA
GetProcessHeap
FreeLibrary
LeaveCriticalSection
Sections
.text Size: 197KB - Virtual size: 197KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 278KB - Virtual size: 278KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ