Static task
static1
Behavioral task
behavioral1
Sample
fc22e624870202e3b2b5cbaa48aaf880_JaffaCakes118.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
fc22e624870202e3b2b5cbaa48aaf880_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
fc22e624870202e3b2b5cbaa48aaf880_JaffaCakes118
-
Size
168KB
-
MD5
fc22e624870202e3b2b5cbaa48aaf880
-
SHA1
f5f4fdda57159af5bf00cc294c94737ac0f14639
-
SHA256
6c21f3bf4816033684a796abfaa21ecb8b5260ffe6d9609fa7584e9045b34359
-
SHA512
464aa00a104e706eacbbd2702b8e0eecdd6ec478b9c666a0aaec38093aa386ed8187065844ff33a49529766203a91630cc4983a70b88922015517f266831f89a
-
SSDEEP
3072:4bZdbRBkMeJFA2tt4FkiTTBU69z2p/rZWiqN+OV2TsEa:WdbRLe79gFkiBU5UNTV2F
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fc22e624870202e3b2b5cbaa48aaf880_JaffaCakes118
Files
-
fc22e624870202e3b2b5cbaa48aaf880_JaffaCakes118.exe windows:4 windows x86 arch:x86
4ef433ff1a5a17c04a9f17bccfd971b1
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
lz32
LZCopy
LZClose
LZOpenFileA
advapi32
RegDeleteKeyA
RegEnumKeyExA
RegQueryValueA
RegQueryValueExA
RegOpenKeyA
RegEnumKeyA
RegOpenKeyExA
RegCloseKey
kernel32
GlobalLock
VirtualAlloc
LocalFree
LocalAlloc
GetTempPathA
AddAtomW
lstrlenA
GetTickCount
DeviceIoControl
VirtualFree
SetFilePointer
DisableThreadLibraryCalls
InterlockedIncrement
CreateFileW
GetFileAttributesA
WideCharToMultiByte
GetFileSize
CreateFileA
SetFileAttributesA
MultiByteToWideChar
CopyFileA
EnumResourceNamesA
GetTempFileNameA
GetLastError
GetSystemTimeAsFileTime
GetModuleFileNameA
WaitForSingleObject
InterlockedDecrement
Sleep
GetCurrentThreadId
CreateMutexA
GetModuleFileNameW
CreateDirectoryA
GetVersionExA
GlobalUnlock
CreateHardLinkW
GlobalFree
GetVolumeInformationA
ReadFile
QueryPerformanceCounter
InitializeCriticalSection
DeleteCriticalSection
GetCurrentProcessId
DeleteFileA
ReleaseMutex
GetSystemTime
CloseHandle
FreeLibrary
setupapi
CM_Get_Child
CMP_WaitNoPendingInstallEvents
SetupDiGetDeviceRegistryPropertyW
CM_Get_DevNode_Status
Sections
.text Size: 91KB - Virtual size: 486KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 74KB - Virtual size: 73KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ