Static task
static1
Behavioral task
behavioral1
Sample
11bc61071af789ba85c6fc3661dd6b8d_JaffaCakes118.exe
Resource
win7-20240215-en
General
-
Target
11bc61071af789ba85c6fc3661dd6b8d_JaffaCakes118
-
Size
600KB
-
MD5
11bc61071af789ba85c6fc3661dd6b8d
-
SHA1
2a080fabc7b2da3fec8b189dbb375949d3cb334b
-
SHA256
f02855ac22e67f1ad9d4c001c86bdfc62f892a5895dac27cdeff02153853396f
-
SHA512
1e92e686b756ca1e1cae1b461765b8b2102e723cdd7a20ad668e053c5fcb3a177c83f950a082750712df41347bce503bdaa33738f66508bd75840ebe2c17aff3
-
SSDEEP
12288:+qlRw5IyPaV1qvXhTDdyayL4NQ/BBXRGJl7TXtaWwyITXf30ebIQ:+gvV1IhALVBBXReobTXftbIQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 11bc61071af789ba85c6fc3661dd6b8d_JaffaCakes118
Files
-
11bc61071af789ba85c6fc3661dd6b8d_JaffaCakes118.exe windows:5 windows x86 arch:x86
78ec7664a2f99443d25462b1ca9c20a0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleA
ActivateActCtx
GlobalLock
GetStringTypeExA
SetConsoleMode
ResetEvent
QueryDosDeviceW
WriteConsoleW
GetProcAddress
GetTickCount
GetLastError
GetThreadPriorityBoost
lstrlenA
GetCPInfo
GetSystemWindowsDirectoryA
GetNumaAvailableMemoryNode
GetOverlappedResult
InterlockedDecrement
FreeEnvironmentStringsA
GlobalAlloc
DosDateTimeToFileTime
FileTimeToDosDateTime
LockFile
GlobalWire
EnumDateFormatsW
AddConsoleAliasA
ReplaceFileA
GetVersionExA
TerminateProcess
UpdateResourceW
ExitProcess
InterlockedIncrement
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
RtlUnwind
RaiseException
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleFileNameW
GetCommandLineA
GetStartupInfoA
HeapValidate
IsBadReadPtr
TlsGetValue
GetModuleHandleW
TlsAlloc
TlsSetValue
GetCurrentThreadId
TlsFree
SetLastError
SetHandleCount
GetStdHandle
GetFileType
DebugBreak
WriteFile
OutputDebugStringA
OutputDebugStringW
LoadLibraryW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
HeapFree
VirtualFree
FlushFileBuffers
GetConsoleCP
GetConsoleMode
HeapAlloc
HeapSize
HeapReAlloc
VirtualAlloc
GetACP
GetOEMCP
IsValidCodePage
InitializeCriticalSectionAndSpinCount
MultiByteToWideChar
ReadFile
SetFilePointer
LoadLibraryA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
CloseHandle
CreateFileA
advapi32
DestroyPrivateObjectSecurity
RegisterServiceCtrlHandlerW
CloseServiceHandle
OpenServiceA
MapGenericMask
DuplicateTokenEx
IsTokenRestricted
RegQueryInfoKeyA
GetSidIdentifierAuthority
SetServiceObjectSecurity
SetServiceStatus
GetSidLengthRequired
RegDeleteValueW
OpenProcessToken
Sections
.text Size: 146KB - Virtual size: 145KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 42KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 345KB - Virtual size: 464KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 49KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ