Static task
static1
Behavioral task
behavioral1
Sample
468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118
-
Size
3.8MB
-
MD5
468dcdb06c6733d0048a75360d52e1a4
-
SHA1
eb1ad2cb3ddb7ac6560cf30cc7c286bd31989b1d
-
SHA256
803f140bd2b1a74fe2334a0f68337fbd85adc6074dff8fc6bea58b6f2a5ab457
-
SHA512
b78b6e303b4264727e157e559fcb947c7016087e453d4449001a5378297fc6306cec59aabec418f4a08e32101d7e74eca689a8801de451dbb76c5e696f4b0909
-
SSDEEP
49152:ARuPPnhH53LFZLGbPG/mvDI7ZpZGyip8QCW3c7DfjqcPm93gBmXjKozboyujkXOa:AebSqmvkd6y/WcHjlm93kKKglWVJM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118
Files
-
468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe windows:5 windows x86 arch:x86
96e7e17b689a2a8307855c981147670c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ClearCommError
DeleteVolumeMountPointA
SetConsoleTextAttribute
ReadConsoleA
FlushConsoleInputBuffer
FlushViewOfFile
FindFirstFileExW
ConnectNamedPipe
GetTickCount
GetCommConfig
GetProcessTimes
GetVolumePathNameW
WideCharToMultiByte
SizeofResource
GetConsoleAliasW
GetWriteWatch
GetAtomNameW
GetEnvironmentVariableA
DisconnectNamedPipe
GetLargestConsoleWindowSize
GetLastError
GetLongPathNameW
GetProcAddress
UnmapViewOfFile
EnumSystemCodePagesW
GetNumaHighestNodeNumber
GetPrivateProfileStringA
SetFileApisToOEM
LoadLibraryA
ProcessIdToSessionId
LocalAlloc
SetCalendarInfoW
IsWow64Process
BuildCommDCBAndTimeoutsW
FindFirstVolumeMountPointW
SetConsoleCtrlHandler
CreatePipe
GetModuleFileNameA
GetDefaultCommConfigA
WTSGetActiveConsoleSessionId
CreateIoCompletionPort
_lread
CompareStringA
GetWindowsDirectoryW
FindNextVolumeA
CreateFileA
lstrlenA
IsBadStringPtrW
HeapReAlloc
SetVolumeLabelW
GetVolumeNameForVolumeMountPointA
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
SetFilePointer
GetModuleHandleW
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
RtlUnwind
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
MultiByteToWideChar
SetStdHandle
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetModuleHandleA
InitializeCriticalSectionAndSpinCount
HeapAlloc
VirtualAlloc
RaiseException
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
ReadFile
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
HeapSize
CloseHandle
user32
GetCursorInfo
advapi32
DeregisterEventSource
EnumServicesStatusA
SetAclInformation
CloseEventLog
Sections
.text Size: 61KB - Virtual size: 61KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3.6MB - Virtual size: 4.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 31KB - Virtual size: 2.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ