Static task
static1
Behavioral task
behavioral1
Sample
fcac6af96d814f68c9a48d9cc5ad91ed_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
fcac6af96d814f68c9a48d9cc5ad91ed_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
fcac6af96d814f68c9a48d9cc5ad91ed_JaffaCakes118
-
Size
288KB
-
MD5
fcac6af96d814f68c9a48d9cc5ad91ed
-
SHA1
36b08b55610672aa0559b54af52012d5c69528ab
-
SHA256
03779c90de7c1f241a905db8f7537b36b66dcf31ddf8ff78f68a1eafbcfffa75
-
SHA512
eaeac6644fb8f81c5881fe68ee6e2839b7f38fc130fad16d7b686321571f11773cd3324ee3849afaf5b497612098959fffbde314a32435d453a9ea9efcb7ba88
-
SSDEEP
6144:W1F00rpPU0FQkk8EbpbkP+IJ124PUmmz0AxYqMEfUm4No3yhio1:SU0FQog1gzjzAxYqRsW3Yio
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fcac6af96d814f68c9a48d9cc5ad91ed_JaffaCakes118
Files
-
fcac6af96d814f68c9a48d9cc5ad91ed_JaffaCakes118.exe windows:4 windows x86 arch:x86
d549f5754d7d13834a5885a05bad8c00
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
malloc
_strlwr
fclose
fwrite
fopen
_snprintf
sprintf
_memicmp
strchr
_stricmp
time
fread
fseek
getenv
swprintf
fprintf
_errno
wcslen
ftell
wcscpy
_snwprintf
wcscspn
wcsncmp
_wtoi
rand
srand
wcscat
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
free
ntdll
NtSetInformationProcess
NtQueryInformationProcess
user32
wsprintfW
GetForegroundWindow
ReleaseDC
GetDC
GetCursorPos
GetSystemMetrics
advapi32
RegCreateKeyExA
RegSetValueExA
RegOpenCurrentUser
RevertToSelf
ImpersonateLoggedOnUser
SetEntriesInAclA
SetSecurityInfo
LookupPrivilegeValueA
AdjustTokenPrivileges
CheckTokenMembership
OpenProcessToken
GetTokenInformation
EqualSid
RegEnumValueA
RegEnumKeyA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
GetUserNameA
OpenSCManagerA
OpenServiceA
QueryServiceStatus
QueryServiceConfigA
CloseServiceHandle
ChangeServiceConfigA
StartServiceA
InitializeSecurityDescriptor
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorDacl
SetFileSecurityW
FreeSid
ole32
CoCreateInstance
CoUninitialize
CoInitialize
shell32
SHGetSpecialFolderPathA
ord680
ShellExecuteExW
CommandLineToArgvW
wininet
HttpAddRequestHeadersA
HttpOpenRequestA
HttpQueryInfoA
InternetReadFile
InternetCloseHandle
InternetSetOptionA
InternetConnectA
InternetOpenA
HttpSendRequestA
ws2_32
WSAStartup
WSACleanup
gdi32
GetDeviceCaps
iphlpapi
GetAdaptersInfo
kernel32
ExitThread
GetModuleHandleA
GetStartupInfoA
GetFullPathNameW
GetCommandLineW
GetCurrentThreadId
QueryPerformanceCounter
RtlUnwind
ExitProcess
DeleteFileW
GetProcAddress
GetCurrentProcess
FindNextFileA
VerifyVersionInfoA
GetVersionExA
GetVersion
GetLastError
Sleep
GetFileAttributesA
GetVolumeNameForVolumeMountPointA
GetSystemDirectoryA
GetVolumeInformationA
FindFirstFileA
FindClose
GetTickCount
CloseHandle
Process32Next
VerSetConditionMask
GetModuleFileNameA
Process32First
CreateToolhelp32Snapshot
Module32First
GetSystemTimeAsFileTime
FreeLibrary
LoadLibraryA
LocalFree
DuplicateHandle
OpenProcess
ProcessIdToSessionId
VirtualProtect
VirtualFree
VirtualAlloc
Module32Next
IsBadReadPtr
GetCurrentProcessId
OpenMutexA
GetComputerNameA
GetTempPathA
GetSystemInfo
GlobalMemoryStatusEx
GetDiskFreeSpaceExA
FlushInstructionCache
MoveFileExA
CreateProcessA
SetFileAttributesW
Sections
.text Size: 63KB - Virtual size: 62KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 208KB - Virtual size: 502KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ