Static task
static1
Behavioral task
behavioral1
Sample
0773f1fc758e41d5ad069d4fc2c91bd5_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0773f1fc758e41d5ad069d4fc2c91bd5_JaffaCakes118.exe
Resource
win10v2004-20240419-en
General
-
Target
0773f1fc758e41d5ad069d4fc2c91bd5_JaffaCakes118
-
Size
1.4MB
-
MD5
0773f1fc758e41d5ad069d4fc2c91bd5
-
SHA1
6c4a602f8f549152202f44e97aa99942cc50c458
-
SHA256
fe4f830d673b344cdf005f01ba6641d6b5a54c75c3ce809f8fcaeb2bf24e1f47
-
SHA512
20ff87e54b831a3b077b00a769535cb534b294685aabcc59ae636dec4a6f3f7182cda5221e76f20dae48a800855885c4dadcec1c269efb6ae5728feee420706f
-
SSDEEP
24576:VsO7Yui3ICVWk+JjRW8x02MGvhfDOM35/ZGc25mBY:g3FVtsjRW8Bhfi6ZZb2MY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0773f1fc758e41d5ad069d4fc2c91bd5_JaffaCakes118
Files
-
0773f1fc758e41d5ad069d4fc2c91bd5_JaffaCakes118.exe windows:5 windows x86 arch:x86
8771d13f5d6a5209a72f41ba1241fe15
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
setupapi
CM_Locate_DevNodeW
CM_Get_Parent
CM_Get_DevNode_Status
CM_Get_DevNode_Registry_Property_ExW
CM_Get_Device_ID_ExW
CM_Get_Device_IDW
SetupDiGetActualSectionToInstallW
SetupDiSetClassInstallParamsW
SetupDiSetDeviceInstallParamsW
SetupDiGetDeviceInstallParamsW
SetupDiSetDeviceRegistryPropertyW
SetupDiOpenDevRegKey
SetupDiCallClassInstaller
SetupDiGetClassDevsExW
SetupDiGetClassDevsW
SetupDiGetDriverInfoDetailW
SetupDiBuildDriverInfoList
SetupDiGetDeviceInterfaceDetailW
SetupDiGetDeviceInstanceIdW
SetupDiOpenDeviceInfoW
SetupDiCreateDeviceInfoListExW
SetupInstallFromInfSectionW
SetupCloseFileQueue
SetupOpenFileQueue
SetupGetIntField
SetupGetStringFieldW
SetupGetFieldCount
SetupFindFirstLineW
SetupCloseInfFile
SetupOpenInfFileW
comdlg32
GetOpenFileNameW
GetFileTitleW
crypt32
CryptProtectData
CertNameToStrW
CryptHashPublicKeyInfo
CryptExportPKCS8
CryptAcquireCertificatePrivateKey
CryptExportPublicKeyInfo
CertVerifyTimeValidity
CryptHashCertificate
CertAddStoreToCollection
CertVerifyCertificateChainPolicy
CertSetCertificateContextProperty
CertCreateCertificateContext
CertEnumCertificatesInStore
CertCloseStore
CryptMsgUpdate
CryptMsgClose
CryptMsgOpenToDecode
CryptEnumOIDInfo
CryptFindOIDInfo
CryptEncodeObject
CryptStringToBinaryW
CertGetCertificateContextProperty
CryptBinaryToStringW
kernel32
GetOEMCP
GetCPInfo
IsValidCodePage
IsDebuggerPresent
IsProcessorFeaturePresent
LoadLibraryExW
RtlUnwind
OutputDebugStringW
HeapReAlloc
GetStringTypeW
HeapSize
LCMapStringW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetStdHandle
SetFilePointerEx
WriteConsoleW
CreateFileW
GetACP
FileTimeToSystemTime
GetProcAddress
VirtualAlloc
HeapDestroy
HeapAlloc
HeapFree
GetCurrentProcessId
GetEnvironmentStringsW
GetCurrentThreadId
GetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
WaitForMultipleObjects
FindClose
CloseHandle
GetSystemTimeAsFileTime
GetSystemInfo
FormatMessageW
CreateFileMappingW
GetModuleHandleW
GetCommandLineW
ExpandEnvironmentStringsW
GetSystemDirectoryW
FindFirstFileW
MultiByteToWideChar
GetCommandLineA
SetLastError
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
WideCharToMultiByte
GetProcessHeap
GetStdHandle
GetFileType
GetStartupInfoW
GetModuleFileNameA
WriteFile
GetModuleFileNameW
QueryPerformanceCounter
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
userenv
ExpandEnvironmentStringsForUserW
RegisterGPNotification
LoadUserProfileW
Sections
.text Size: 77KB - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 942KB - Virtual size: 7.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 364KB - Virtual size: 364KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ