Static task
static1
Behavioral task
behavioral1
Sample
128b26f383a1f6bb071df23e1cfb82af_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
128b26f383a1f6bb071df23e1cfb82af_JaffaCakes118.exe
Resource
win10v2004-20240419-en
General
-
Target
128b26f383a1f6bb071df23e1cfb82af_JaffaCakes118
-
Size
1.6MB
-
MD5
128b26f383a1f6bb071df23e1cfb82af
-
SHA1
c9dab1c522d5cff0defb801acf634d948384e79e
-
SHA256
e4f54bbd59b269cffb0d0bf1a4ac0f37d931af813c9944991cc7dbeb9bffcd6b
-
SHA512
a2003412b7cd56e5d418de7564e00ff873235350d81e540f57be4f6eb47e001e1674be509f70b78dff1db288fa0fe9d7856b7f4ebc9ff7c94f6cbc4c55ea0b2b
-
SSDEEP
24576:Pj2iZXSjoekb9TXahIoFRFGM/SJLMJ3GAOxW4PLSf:ejoekb9LYIWRdSuFShPLSf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 128b26f383a1f6bb071df23e1cfb82af_JaffaCakes118
Files
-
128b26f383a1f6bb071df23e1cfb82af_JaffaCakes118.exe windows:6 windows x86 arch:x86
cef6f8e4fe6826a4fca477c0b4b9105f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
EnumSystemLocalesEx
EnumSystemLocalesW
ExitProcess
ExpandEnvironmentStringsW
FileTimeToSystemTime
FindClose
FindFirstFileExW
FindNextFileW
FlushFileBuffers
FlushViewOfFile
FormatMessageA
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetComputerNameExW
GetConsoleCP
GetDateFormatW
GetDriveTypeW
GetEnvironmentStringsW
GetExitCodeProcess
GetFileAttributesW
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFileSizeEx
GetFileType
GetFullPathNameW
GetLastError
GetLocalTime
GetLocaleInfoW
GetLongPathNameW
GetModuleFileNameW
GetModuleHandleA
EnterCriticalSection
GetModuleHandleW
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
K32GetPerformanceInfo
K32GetProcessMemoryInfo
K32QueryWorkingSetEx
LCMapStringW
LeaveCriticalSection
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
LocalFree
LockFileEx
MapViewOfFile
MoveFileW
MultiByteToWideChar
OpenProcess
SetConsoleCtrlHandler
SetCurrentDirectoryW
SetEndOfFile
SetEnvironmentVariableW
SetEvent
SetFileAttributesW
SetFilePointerEx
SetHandleInformation
SetInformationJobObject
TlsSetValue
WriteConsoleW
CreateFileW
HeapSize
EncodePointer
DuplicateHandle
ConnectNamedPipe
CompareStringW
CloseHandle
VirtualProtectEx
VirtualAllocEx
CreateRemoteThread
GetCurrentProcess
GetModuleHandleExW
Sleep
GetConsoleMode
GetProcessHeap
GetStringTypeW
SetStdHandle
WideCharToMultiByte
GetOEMCP
IsValidCodePage
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
SetLastError
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsFree
GetProcAddress
RaiseException
GetStdHandle
WriteFile
DecodePointer
user32
TranslateMessage
UnregisterClassW
SetProcessWindowStation
advapi32
SetSecurityInfo
SetKernelObjectSecurity
SetEntriesInAclW
IsValidSid
InitializeSid
ImpersonateNamedPipeClient
ImpersonateLoggedOnUser
GetTokenInformation
GetSidSubAuthority
GetSecurityInfo
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
wininet
InternetCheckConnectionA
ws2_32
connect
htons
inet_addr
socket
WSAStartup
Sections
.text Size: 714KB - Virtual size: 714KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 62KB - Virtual size: 61KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 763KB - Virtual size: 766KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 75KB - Virtual size: 74KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ