Static task
static1
Behavioral task
behavioral1
Sample
fa85e05eb1cdf11798761c397e655d8f_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fa85e05eb1cdf11798761c397e655d8f_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
fa85e05eb1cdf11798761c397e655d8f_JaffaCakes118
-
Size
160KB
-
MD5
fa85e05eb1cdf11798761c397e655d8f
-
SHA1
0e8afea86537d3a5a638f0ed3c49ea22023bf7f8
-
SHA256
b39ff05a8bcc0311f07e9e09738c846adb892f954d1a71b06838a909151ea0f1
-
SHA512
140795a7416971e398cfe040a2e5b95c386ebcf9dfcd8742ce3332f8f51299616db17170f4b495aa4c3bae0fd9117b07c2c586e153e392e0588b62c0ac07f14d
-
SSDEEP
3072:/cxx41fb07xggnwcppunaOVpn1eDerLkw9vv9tjrJ/RESI43rm7:/cj4pbEZnwcppuFVpn1eKkoDI43a
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fa85e05eb1cdf11798761c397e655d8f_JaffaCakes118
Files
-
fa85e05eb1cdf11798761c397e655d8f_JaffaCakes118.exe windows:4 windows x86 arch:x86
8a9b0d5a07017d68f94aaf01212e81c2
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrcmpA
LoadLibraryExA
CopyFileA
CreateFileMappingA
GetCurrentProcessId
GetEnvironmentVariableA
GetFileSize
GetFileTime
GetTempFileNameA
GetVersionExA
GlobalAlloc
GlobalFree
lstrcatA
MoveFileExA
ReadFile
ResumeThread
RtlZeroMemory
SetFilePointer
SetFileTime
UnmapViewOfFile
VirtualAlloc
VirtualFree
lstrcmpiA
GetEnvironmentStrings
FreeLibrary
LoadLibraryA
lstrcpynA
lstrcpyA
SleepEx
WinExec
MoveFileA
Module32First
Module32Next
FindResourceA
SizeofResource
LoadResource
LockResource
WriteFile
ExitProcess
CreateToolhelp32Snapshot
Process32First
Process32Next
GetSystemDirectoryA
lstrlenW
VirtualAllocEx
WriteProcessMemory
GetModuleHandleA
GetProcAddress
CreateRemoteThread
WaitForSingleObject
VirtualFreeEx
GetCurrentThread
LocalAlloc
LocalFree
GetWindowsDirectoryA
DeleteFileA
GetCurrentProcess
OpenProcess
TerminateProcess
Sleep
lstrlenA
CloseHandle
CreateFileA
DeviceIoControl
GetLastError
GetModuleFileNameA
MapViewOfFile
HeapReAlloc
IsBadWritePtr
WideCharToMultiByte
MultiByteToWideChar
HeapCreate
LCMapStringW
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
SetStdHandle
FlushFileBuffers
GetCPInfo
GetACP
GetOEMCP
GetStringTypeA
GetStringTypeW
SetEndOfFile
HeapDestroy
GetVersion
GetCommandLineA
GetStartupInfoA
RtlUnwind
HeapFree
HeapAlloc
LCMapStringA
RaiseException
user32
IsCharAlphaA
IsCharAlphaNumericA
wsprintfA
wsprintfW
GetSystemMetrics
advapi32
RegOpenKeyExA
RegQueryInfoKeyA
RegQueryValueExA
RegOpenKeyA
QueryServiceStatus
ImpersonateSelf
OpenThreadToken
AllocateAndInitializeSid
InitializeSecurityDescriptor
GetLengthSid
InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
IsValidSecurityDescriptor
AccessCheck
RevertToSelf
FreeSid
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegEnumKeyExA
RegDeleteKeyA
CreateServiceA
RegSetValueExA
StartServiceA
OpenSCManagerA
OpenServiceA
CloseServiceHandle
ControlService
GetUserNameA
RegCreateKeyA
RegDeleteValueA
RegCloseKey
ChangeServiceConfigA
LockServiceDatabase
CreateProcessAsUserA
UnlockServiceDatabase
psapi
GetModuleBaseNameA
GetModuleFileNameExA
EnumProcesses
EnumProcessModules
imagehlp
MapFileAndCheckSumA
mapi32
ord17
ord135
ord23
ord11
ord21
ord140
oleaut32
GetErrorInfo
Sections
.text Size: 56KB - Virtual size: 54KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 74KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 84KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ