Static task
static1
Behavioral task
behavioral1
Sample
2cd8d32820e993ababc07d1a59db1227_JaffaCakes118.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2cd8d32820e993ababc07d1a59db1227_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
2cd8d32820e993ababc07d1a59db1227_JaffaCakes118
-
Size
200KB
-
MD5
2cd8d32820e993ababc07d1a59db1227
-
SHA1
1535636eb970e7d7c134c1fe26b4f79618e94599
-
SHA256
9f876e038d4bd25b41781469fbe7f3daa4f0f7a306b26d34dda2a428c1e6f78b
-
SHA512
d74fb801ab9de94af9dd4861230d55f5d05e3cde45758c84d630159a38410e53ab0cdf7e4af2bc15cbc477c3ba27f8aa87c964a1f9b5f1c57415d8a702afdbc5
-
SSDEEP
3072:kxEHAGE7NWw22QcAg8Kehx81W09Pl5+kocPHEe6533EVYV7R+:kxEHAfww2rdhx8wKl8kol5E
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2cd8d32820e993ababc07d1a59db1227_JaffaCakes118
Files
-
2cd8d32820e993ababc07d1a59db1227_JaffaCakes118.exe windows:5 windows x86 arch:x86
f7a6e4efb3a11a495e283e14b0c356f3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FindFirstChangeNotificationW
WriteConsoleOutputCharacterW
GetCPInfo
FreeEnvironmentStringsA
LoadLibraryW
GetLastError
GetCurrentDirectoryW
SetLastError
LocalAlloc
FindNextChangeNotification
AddAtomA
VirtualProtect
FindAtomW
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
ExitProcess
HeapSize
FlushFileBuffers
HeapAlloc
GetCommandLineA
GetStartupInfoA
RaiseException
RtlUnwind
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualFree
VirtualAlloc
HeapReAlloc
HeapCreate
GetModuleHandleW
Sleep
GetProcAddress
WriteFile
GetStdHandle
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
InterlockedDecrement
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
GetACP
GetOEMCP
IsValidCodePage
InitializeCriticalSectionAndSpinCount
LoadLibraryA
CloseHandle
CreateFileA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetModuleHandleA
user32
GetMessageExtraInfo
SetParent
GetMonitorInfoA
GetUpdateRect
RegisterClassExW
GetDesktopWindow
GetCaretPos
SetThreadDesktop
SetProcessDefaultLayout
PeekMessageA
shell32
ExtractIconW
Sections
.text Size: 140KB - Virtual size: 139KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 31KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ