Static task
static1
Behavioral task
behavioral1
Sample
475a6bba78d09611e80c91dab3e839e9_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
475a6bba78d09611e80c91dab3e839e9_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
475a6bba78d09611e80c91dab3e839e9_JaffaCakes118
-
Size
758KB
-
MD5
475a6bba78d09611e80c91dab3e839e9
-
SHA1
4d250525e9a20f955d5cb21526e21d6624e9a814
-
SHA256
7f899ad1b55bf3fb3030b457d311d9154a4e0ef0087c4aa3df44af19fe3e1cbf
-
SHA512
b1ed778e601f4e919f7d01db3ad11d84ec4adc868780986d2825fc26fb87a13ba60adcae6428ff54dc0c533105f6fbc0507e8f48d7ed99c5cb173cc756a1ed1f
-
SSDEEP
12288:MKrnlZHjXnJ0gDe4z/EfiwKRrOkL+IogS1I63AyYAy65IbY/pJfJZDqMsrQG:HHjdzzK1KIkL+R/G6waXJfDq5cG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 475a6bba78d09611e80c91dab3e839e9_JaffaCakes118
Files
-
475a6bba78d09611e80c91dab3e839e9_JaffaCakes118.exe windows:6 windows x86 arch:x86
79cf290ab0b83618ec7a12cc201e7929
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
StrCpyNW
netapi32
NetApiBufferFree
NetWkstaGetInfo
wininet
InternetCheckConnectionW
kernel32
SetWaitableTimer
LeaveCriticalSection
EnterCriticalSection
TlsFree
TlsAlloc
TlsSetValue
TlsGetValue
CloseHandle
WaitForSingleObject
SleepEx
SetEvent
CreateEventW
QueueUserAPC
TerminateThread
WaitForMultipleObjects
DeleteCriticalSection
CreateIoCompletionPort
InitializeCriticalSectionAndSpinCount
VerifyVersionInfoW
VerSetConditionMask
GetNativeSystemInfo
GetCurrentProcess
SetLastError
CopyFileW
lstrlenW
GetTempFileNameW
GetTickCount
CreateMutexW
CreateMutexA
ExitProcess
DeleteFileW
RemoveDirectoryW
AllocConsole
SetConsoleTextAttribute
GetStdHandle
WriteConsoleW
ReadConsoleInputW
FreeConsole
GetLocalTime
OpenEventW
InitializeCriticalSection
GetModuleHandleA
VirtualProtect
lstrcmp
GetModuleFileNameW
CreateProcessW
GetModuleHandleW
GetQueuedCompletionStatus
PostQueuedCompletionStatus
MoveFileExW
GetTickCount64
GetLastError
SetStdHandle
ReadConsoleW
HeapSize
GlobalMemoryStatusEx
FindClose
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
GetTimeZoneInformation
GetProcessHeap
ReadFile
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetACP
WriteFile
SetEnvironmentVariableA
HeapReAlloc
HeapFree
HeapAlloc
GetCommandLineW
GetCommandLineA
GetModuleHandleExW
ExitThread
RaiseException
RtlUnwind
WideCharToMultiByte
DuplicateHandle
WaitForSingleObjectEx
Sleep
GetCurrentThread
GetCurrentThreadId
QueryPerformanceCounter
TryEnterCriticalSection
MultiByteToWideChar
CreateFileW
FindFirstFileExW
FindNextFileW
SetEndOfFile
SetFilePointerEx
AreFileApisANSI
EncodePointer
DecodePointer
GetSystemTimeAsFileTime
GetProcAddress
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
LocalFree
FormatMessageA
GetEnvironmentVariableW
GetFileAttributesW
DeviceIoControl
GetWindowsDirectoryW
ResetEvent
InitializeSListHead
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
CreateTimerQueue
SignalObjectAndWait
SwitchToThread
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibrary
FreeLibraryAndExitThread
LoadLibraryExW
GetVersionExW
VirtualAlloc
VirtualFree
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
LoadLibraryW
advapi32
CryptGenRandom
CryptReleaseContext
CryptAcquireContextW
RegDeleteTreeW
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
GetTokenInformation
OpenProcessToken
RegDeleteValueW
shell32
SHGetFolderPathAndSubDirW
ole32
CoInitializeEx
CoUninitialize
CoCreateGuid
StringFromGUID2
CoInitializeSecurity
CoCreateInstance
oleaut32
VariantInit
VariantClear
SysFreeString
SysAllocString
ws2_32
ioctlsocket
WSASetLastError
WSAGetLastError
closesocket
WSACleanup
getaddrinfo
freeaddrinfo
getsockopt
select
setsockopt
shutdown
htonl
ntohl
htons
WSACloseEvent
WSAEventSelect
WSACreateEvent
WSASocketW
WSAStartup
connect
WSASend
WSARecv
Sections
.text Size: 581KB - Virtual size: 581KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 131KB - Virtual size: 131KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 18KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
init Size: 512B - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ