Static task
static1
Behavioral task
behavioral1
Sample
0c0033da5fc975ca7031bc3c12b7e262_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0c0033da5fc975ca7031bc3c12b7e262_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
0c0033da5fc975ca7031bc3c12b7e262_JaffaCakes118
-
Size
1.2MB
-
MD5
0c0033da5fc975ca7031bc3c12b7e262
-
SHA1
3c30dd3e644534810930397cc16c0899171e2194
-
SHA256
dd707cdb1d3fd232b21db920d5e8a70c57a77f56965a13a1df5bb57f6d890010
-
SHA512
923887be6be26492c9829a641cbbafd350abd3c8ddf102095056b6ca4ca86cad3bf18640d44c7c5a39dd7d124613fa085cde90e718a6852fc831ca9db8d4d4f7
-
SSDEEP
24576:MGcys4uC2hcx9B5yI7pnPbI5hGYQ9ZHyFgsazTDLhj3xOXE9:w9cF5Vnzc9Q37JTD1twE9
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0c0033da5fc975ca7031bc3c12b7e262_JaffaCakes118
Files
-
0c0033da5fc975ca7031bc3c12b7e262_JaffaCakes118.exe windows:5 windows x86 arch:x86
29d067b80c29b79650ba3a8ed97a46c4
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
VirtualAlloc
GetCurrentThreadId
GetLastError
EnterCriticalSection
WriteFile
CloseHandle
FileTimeToSystemTime
lstrlenW
GetModuleFileNameW
GetCommandLineW
LocalFree
DeleteFileW
IsValidCodePage
GetOEMCP
WideCharToMultiByte
ExpandEnvironmentStringsW
GlobalLock
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
InitializeCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
HeapAlloc
HeapReAlloc
GetProcAddress
LoadLibraryA
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
InterlockedDecrement
InterlockedIncrement
shell32
SHChangeNotify
mpr
WNetGetConnectionW
WNetGetUniversalNameW
comdlg32
ChooseColorW
Sections
.text Size: 59KB - Virtual size: 59KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 93KB - Virtual size: 6.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.nn3et0 Size: 677KB - Virtual size: 677KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 369KB - Virtual size: 368KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ