_gekelberifin@8
Static task
static1
Behavioral task
behavioral1
Sample
38bb82704f322847204a500e31fcc5ae_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
38bb82704f322847204a500e31fcc5ae_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
38bb82704f322847204a500e31fcc5ae_JaffaCakes118
-
Size
3.7MB
-
MD5
38bb82704f322847204a500e31fcc5ae
-
SHA1
2dbb972977a898d0c4b9c2636b3e64a12c716fa7
-
SHA256
404369ff8189cab77c5027497eb9bc9836568d70d4bad5124d83226d165874ed
-
SHA512
59869cb0377cb8f062d35ccdeae900cb2a2701263f44add7556121a45f5ec5bbcbedb590144163e9c8e8c3cf53919513aa5bcfeabe34d16ad3b075b04e15c0cd
-
SSDEEP
98304:zJU/0mKYHNWOXX0ttQZXQlKuQUhbErXagCFdQ0Jkn:za/0Mn0jQ5QfhbWX7GQ1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 38bb82704f322847204a500e31fcc5ae_JaffaCakes118
Files
-
38bb82704f322847204a500e31fcc5ae_JaffaCakes118.exe windows:5 windows x86 arch:x86
5fcdfeb1c3c0323f0647fc2922ca3cc3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
EnumResourceNamesW
OpenFile
lstrlenA
WritePrivateProfileStructA
TlsGetValue
ScrollConsoleScreenBufferW
CreateJobObjectW
OpenSemaphoreA
ConnectNamedPipe
CallNamedPipeW
FreeEnvironmentStringsA
_lclose
GetProcessPriorityBoost
CreateNamedPipeW
ReadConsoleW
WriteFile
GetUserDefaultLangID
GetCommandLineA
SetCommTimeouts
FindResourceExA
GlobalAlloc
LoadLibraryW
Sleep
GetPrivateProfileStructW
GetVersionExW
DeleteVolumeMountPointW
SetConsoleMode
WriteConsoleW
GetBinaryTypeA
lstrcatA
FillConsoleOutputCharacterA
GlobalUnlock
DeactivateActCtx
InterlockedExchange
GlobalUnfix
SetCurrentDirectoryA
GetLastError
IsDBCSLeadByteEx
GetTapeStatus
SetVolumeLabelW
EnterCriticalSection
_hwrite
SetFileApisToOEM
GetLocalTime
OpenMutexA
SetCalendarInfoW
BeginUpdateResourceA
PostQueuedCompletionStatus
WriteProfileSectionW
AddAtomA
GetTapeParameters
WaitForMultipleObjects
GetModuleHandleA
LoadLibraryExA
VirtualProtect
EnumDateFormatsW
GetConsoleCursorInfo
LocalSize
lstrcpyA
SetThreadPriority
FileTimeToDosDateTime
GetStartupInfoA
SetUnhandledExceptionFilter
GetModuleHandleW
GetProcAddress
ExitProcess
GetStdHandle
GetModuleFileNameA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
VirtualAlloc
HeapReAlloc
RtlUnwind
HeapSize
GetLocaleInfoA
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
user32
GetCursorPos
gdi32
GetBitmapDimensionEx
Exports
Exports
Sections
.text Size: 3.7MB - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 3.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.xudih Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.xiwenox Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 15KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ