Static task
static1
Behavioral task
behavioral1
Sample
3c110672a23f1f8d44445a26044a4f0d_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
3c110672a23f1f8d44445a26044a4f0d_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
3c110672a23f1f8d44445a26044a4f0d_JaffaCakes118
-
Size
980KB
-
MD5
3c110672a23f1f8d44445a26044a4f0d
-
SHA1
d6919b39b86c20f5f312cba3939d4c0c6880b666
-
SHA256
5f94d30208bd6461923fa937b7eeb4da809a0a3042baf4822fd5f450ac586e37
-
SHA512
5785f64bb172d0d16835048b1f2e56de7c495b03819b55e5850c20bdd69ae79cfc54435bc95bae2354df30c140468e3f462d1cb1bf1c6a969113ef9d9405d8f4
-
SSDEEP
12288:3RNEXwIeUibkrXh7IHR6vfsCTe4KBSeFFDCNGnzG6zhlDlgocBWzpjHGfAzZ7:3PEneUzr868X4KBvFoetJcWzBHHN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3c110672a23f1f8d44445a26044a4f0d_JaffaCakes118
Files
-
3c110672a23f1f8d44445a26044a4f0d_JaffaCakes118.exe windows:5 windows x86 arch:x86
bf178548d7980cf9ea9387a0baa54873
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
wininet
InternetCrackUrlW
InternetQueryOptionW
InternetSetOptionW
InternetOpenW
ole32
CoTaskMemAlloc
ReleaseStgMedium
CreateStreamOnHGlobal
CoGetMalloc
CLSIDFromProgID
kernel32
SetUnhandledExceptionFilter
CreateFileW
WriteConsoleW
SetFilePointerEx
SetStdHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
VirtualAlloc
GetCurrentThreadId
GetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetFileSize
CloseHandle
GetStartupInfoW
OutputDebugStringW
GetTempPathW
GetFileAttributesW
QueryPerformanceCounter
GetLocaleInfoW
GetCommandLineW
SetLastError
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
WideCharToMultiByte
GetProcessHeap
GetStdHandle
GetFileType
GetModuleFileNameW
WriteFile
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
LCMapStringW
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
HeapFree
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
IsDebuggerPresent
IsProcessorFeaturePresent
LoadLibraryExW
RtlUnwind
HeapAlloc
HeapReAlloc
GetStringTypeW
HeapSize
secur32
DeleteSecurityContext
FreeCredentialsHandle
Sections
.text Size: 79KB - Virtual size: 78KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 870KB - Virtual size: 7.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ