Static task
static1
Behavioral task
behavioral1
Sample
Joke/W95JOKE.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Joke/W95JOKE.exe
Resource
win10v2004-20240226-en
General
-
Target
3893c11d6176207f1bc57909e7b7d204_JaffaCakes118
-
Size
14KB
-
MD5
3893c11d6176207f1bc57909e7b7d204
-
SHA1
443ef0d6cdce399d7ec7fb6d982f89eb082948df
-
SHA256
e4946b60d824917b0117b1f5ac5adc4dd332738897ccb1fe328f9f6fdb9df63d
-
SHA512
04d26e17d3a9e57a72d06fde3fbff178ae03e86819981b898bfaa1f3676a0737e151030a0cc55b657f313cedfa8b971216686396b75b15b2f2096730459b53b1
-
SSDEEP
192:q9x4jcY5/p++9D2X3ijynm8M6suCkzS191e5ardVdN4xEW38Ba+0JioUDtH:qv4oUB+Oxd84DkzS19A5arndA99sVtH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Joke/W95JOKE.EXE
Files
-
3893c11d6176207f1bc57909e7b7d204_JaffaCakes118.rar
-
Joke/Aramis.txt
-
Joke/W95JOKE.EXE.exe windows:4 windows x86 arch:x86
c75180bede4a57beee7ea0374f24c648
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersion
Sleep
GetProcAddress
ExitProcess
LCMapStringA
GetStringTypeW
LCMapStringW
LoadLibraryA
HeapAlloc
GetStringTypeA
WriteFile
HeapFree
GetStdHandle
GetFileType
HeapCreate
GetOEMCP
GetACP
SetHandleCount
WideCharToMultiByte
GetEnvironmentStringsW
GetCPInfo
GetEnvironmentStrings
MultiByteToWideChar
FreeEnvironmentStringsW
GetModuleFileNameA
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetProfileIntA
UnhandledExceptionFilter
FreeEnvironmentStringsA
TerminateProcess
GetCurrentProcess
RtlUnwind
user32
GetWindowLongA
SetParent
SetWindowPos
SetWindowLongA
SendMessageA
DestroyWindow
PostQuitMessage
DefWindowProcA
MessageBoxA
WinHelpA
GetFocus
LoadCursorA
CreateWindowExA
LoadIconA
GetWindow
RegisterClassA
FindWindowA
SetTimer
SetForegroundWindow
LoadBitmapA
DispatchMessageA
GetMessageA
TranslateMessage
Sections
.text Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ