Static task
static1
Behavioral task
behavioral1
Sample
4954ad5a743bc78e9311753829931a8e_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
4954ad5a743bc78e9311753829931a8e_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
4954ad5a743bc78e9311753829931a8e_JaffaCakes118
-
Size
561KB
-
MD5
4954ad5a743bc78e9311753829931a8e
-
SHA1
8c9a479bda9467457e66d185d6370c2010766c79
-
SHA256
b8cf0945694d2ed2d90a73475f0c81c0ffce06dbace9d6e12b2e132985e71d48
-
SHA512
abd061ed528306fe33ec3cb541c59c455ab549c4470f93426a8aa915cc95061079f3ef32d29a21ed0e2ae0ed9fedcf68a08407b7fb20cd262376de6d6589bbb4
-
SSDEEP
6144:+FgN1ejdwFKSZh2+tIRsB1Q/ZpvHX1wXyV9aiA6lVDVLBbl8BbVDrXGBkBlpCp2e:nYdwFK8YLHZhXYyWi3lrvMVfXGeBlp5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4954ad5a743bc78e9311753829931a8e_JaffaCakes118
Files
-
4954ad5a743bc78e9311753829931a8e_JaffaCakes118.exe windows:5 windows x86 arch:x86
d7fde2df491a40999a2da34ae424bbaa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
comdlg32
ChooseFontA
ChooseColorA
CommDlgExtendedError
GetSaveFileNameW
GetOpenFileNameW
version
VerQueryValueA
GetFileVersionInfoA
kernel32
VirtualFree
CreateFileA
SetStdHandle
SetFilePointer
WriteConsoleW
GlobalAlloc
GetProcAddress
GetLocalTime
GetSystemTimeAsFileTime
GetCommandLineA
GetStartupInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
GetModuleHandleW
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetLastError
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
HeapFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
RtlUnwind
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
MultiByteToWideChar
LoadLibraryA
InitializeCriticalSectionAndSpinCount
HeapAlloc
VirtualAlloc
HeapReAlloc
GetConsoleCP
GetConsoleMode
FlushFileBuffers
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
ReadFile
HeapSize
CloseHandle
WriteConsoleA
GetConsoleOutputCP
Sections
.text Size: 75KB - Virtual size: 75KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 439KB - Virtual size: 438KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 179KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 41KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ