Static task
static1
Behavioral task
behavioral1
Sample
1861f5f5c1bf4c6eabe0b6fc8d792019_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1861f5f5c1bf4c6eabe0b6fc8d792019_JaffaCakes118.exe
Resource
win10v2004-20240419-en
General
-
Target
1861f5f5c1bf4c6eabe0b6fc8d792019_JaffaCakes118
-
Size
499KB
-
MD5
1861f5f5c1bf4c6eabe0b6fc8d792019
-
SHA1
a73a74301727189491556bac5146976fb26638ba
-
SHA256
f12851c350ac9d71760465bfe01bc7e17f3dd2575412d99865cde1bbdf16d353
-
SHA512
7d3ce18298009393683532b4f04ebc80ef8e0010a3cff6478e47b580cd97b2f9d5bf4cd2f73feb5b3719a9c1ff5b907a1d998a67a13aeee3fdbadfb4fbfbc6b1
-
SSDEEP
6144:4kJ3VPwv21cNZSa/mZzxPTZSV0h6UOdmPvjqlyQkbs1jqLBcdFuhJVm3Cf1SlyIk:4kJ3twv8cmqmZJTZVvjKyQD1WL2dFuL1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 1861f5f5c1bf4c6eabe0b6fc8d792019_JaffaCakes118
Files
-
1861f5f5c1bf4c6eabe0b6fc8d792019_JaffaCakes118.exe windows:5 windows x86 arch:x86
c6e9a543b0611c033118b880816cea19
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
Imports
kernel32
CreateFileW
SetStdHandle
GetConsoleMode
GetConsoleCP
SetFilePointer
RaiseException
HeapQueryInformation
HeapSize
HeapReAlloc
GetStringTypeW
RtlUnwind
LoadLibraryW
OutputDebugStringW
WriteConsoleW
LeaveCriticalSection
EnterCriticalSection
WriteFile
DeleteCriticalSection
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
ExitProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetEnvironmentStrings
FreeEnvironmentStringsA
GetCurrentThreadId
GetStdHandle
GetConsoleScreenBufferInfo
FillConsoleOutputCharacterA
FillConsoleOutputAttribute
SetConsoleCursorPosition
GetCurrentProcess
CloseHandle
HeapCreate
GetProcessHeap
HeapAlloc
HeapFree
GetTickCount
QueryPerformanceCounter
IsProcessorFeaturePresent
IsBadReadPtr
HeapValidate
LCMapStringW
MultiByteToWideChar
GetLastError
OutputDebugStringA
WideCharToMultiByte
SetLastError
GetModuleHandleW
GetCommandLineA
HeapSetInformation
GetStartupInfoW
EncodePointer
DecodePointer
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleFileNameW
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetProcAddress
FlushFileBuffers
user32
GetDlgItem
SetWindowTextA
GetDC
DispatchMessageA
TranslateMessage
DdeCreateStringHandleA
EnableMenuItem
BeginPaint
SendMessageA
DrawTextW
EndPaint
InvalidateRect
DefWindowProcA
EndDialog
SetDlgItemTextA
GetDlgItemTextA
MessageBoxA
DestroyWindow
GetClientRect
GetWindow
IsWindowVisible
GetWindowTextA
PostMessageA
SetWindowLongA
SendDlgItemMessageA
SetFocus
GetWindowLongA
LoadAcceleratorsA
GetSystemMetrics
LoadIconA
LoadCursorA
RegisterClassExA
CreateWindowExA
ShowWindow
SetForegroundWindow
GetMessageA
GetDesktopWindow
gdi32
SelectObject
EnumFontFamiliesA
CreateFontW
SetTextColor
comdlg32
GetFileTitleW
advapi32
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
FreeSid
AllocateAndInitializeSid
SetTokenInformation
ole32
CLSIDFromString
ws2_32
WSAGetLastError
WSACreateEvent
inet_addr
iphlpapi
NotifyRouteChange
SendARP
IcmpCreateFile
IcmpCloseHandle
shlwapi
PathFileExistsW
powrprof
ReadGlobalPwrPolicy
Sections
.text Size: 136KB - Virtual size: 136KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 41KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tdata Size: 116KB - Virtual size: 115KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.fla Size: 98KB - Virtual size: 98KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.directo Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 76KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ