lYGKNesBcgRHwQgYwYfaqn
Static task
static1
Behavioral task
behavioral1
Sample
42c98b5341530a2d930a24f6b7057f09_JaffaCakes118.exe
Resource
win7-20240508-en
General
-
Target
42c98b5341530a2d930a24f6b7057f09_JaffaCakes118
-
Size
682KB
-
MD5
42c98b5341530a2d930a24f6b7057f09
-
SHA1
be32f9a94c33828b2f048e0db3e1d98e2f3925c7
-
SHA256
f0db68ca72e8d0e129798950875b3902d8d8c7166957d8bbe4fe88848516d803
-
SHA512
bb0ed4218ed4e5982b4384f0bc899c7bb79a1dbad34b10e875e3ac14b9134c762aa3cd709138577572d6445d47a49fcb141c01045e72ac690260093c149f249f
-
SSDEEP
12288:dSu+QgGEsmeKVFXIA33nrbDSL3bhHInj3MqhOHoRlfDcmL8jdvxwrygF:k/QQsmeKVFXIA33n3WL3bhH43+SZN8jF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 42c98b5341530a2d930a24f6b7057f09_JaffaCakes118
Files
-
42c98b5341530a2d930a24f6b7057f09_JaffaCakes118.exe windows:4 windows x86 arch:x86
78c75c93c99b5b728d8048672ad53c6b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
advapi32
SetFileSecurityW
kernel32
AddAtomA
CloseHandle
CreateMutexA
CreateSemaphoreA
DeleteCriticalSection
EnterCriticalSection
FindAtomA
GetAtomNameA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetProcAddress
GetStartupInfoA
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryW
MultiByteToWideChar
QueryPerformanceCounter
ReleaseMutex
ReleaseSemaphore
SetLastError
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
msvcrt
_fdopen
_fileno
_getch
_read
_strdup
_write
__dllonexit
__doserrno
__getmainargs
__initenv
__lconv_init
__mb_cur_max
__pioinfo
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_errno
_filelengthi64
_fileno
_fmode
_fstat64
_initterm
_iob
_lock
_lseeki64
_onexit
_strnicmp
_unlock
_write
abort
atoi
calloc
exit
fclose
fflush
fgetc
fgetpos
fopen
fputc
fputs
fread
free
fsetpos
fwrite
getc
getenv
getwc
isalpha
isspace
iswctype
localeconv
malloc
memchr
memcmp
memcpy
memmove
memset
putc
putwc
rand
realloc
setlocale
setvbuf
signal
sprintf
strchr
strcmp
strcoll
strerror
strftime
strlen
strncmp
strxfrm
system
tolower
towlower
towupper
ungetc
ungetwc
wcscoll
wcsftime
wcslen
wcsxfrm
user32
LoadStringW
Exports
Exports
Sections
.text Size: 477KB - Virtual size: 476KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 31KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 82KB - Virtual size: 81KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 3KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 512B - Virtual size: 86B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 52B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 67KB - Virtual size: 66KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ