Static task
static1
Behavioral task
behavioral1
Sample
35fbcfba029360c1ec1603a4642bc2ad_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
35fbcfba029360c1ec1603a4642bc2ad_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
35fbcfba029360c1ec1603a4642bc2ad_JaffaCakes118
-
Size
3.1MB
-
MD5
35fbcfba029360c1ec1603a4642bc2ad
-
SHA1
2214f3393437a39b84be9da1ec2157ece1cd7fef
-
SHA256
cbf85f3f8275495a0695befb29e2c489a93edb1370962e85f41db0d1b83425c4
-
SHA512
7ba182ed7ae6459ef9a41ac9bd6b8d84f5dffa7ede759763efd5979e3a07792c06596bc177ef28e35d556ad4a31e557f53320fec18e94930369d5d388992c912
-
SSDEEP
98304:b1lL+W+yu2h38X+ktDqyXXoFDMUPUqm6gtyTV:zKJsm194FDZb1Ay
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 35fbcfba029360c1ec1603a4642bc2ad_JaffaCakes118
Files
-
35fbcfba029360c1ec1603a4642bc2ad_JaffaCakes118.exe windows:6 windows x64 arch:x64
291991da8bbbc1b37483031156a68b46
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
Process32Next
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
EmptyClipboard
CharUpperBuffW
advapi32
ConvertStringSecurityDescriptorToSecurityDescriptorA
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
msvcp140
_Cnd_wait
winhttp
WinHttpConnect
vcruntime140
strchr
api-ms-win-crt-runtime-l1-1-0
_register_onexit_function
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-stdio-l1-1-0
fread
api-ms-win-crt-filesystem-l1-1-0
_stat64i32
api-ms-win-crt-string-l1-1-0
isspace
api-ms-win-crt-environment-l1-1-0
getenv_s
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wsock32
setsockopt
ws2_32
getaddrinfo
api-ms-win-crt-convert-l1-1-0
strtoul
wtsapi32
WTSSendMessageW
Sections
.text Size: - Virtual size: 793KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 125KB - Virtual size: 125KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_TEXT_CN Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 2.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 2.9MB - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 1016B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 99KB - Virtual size: 99KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ