Static task
static1
Behavioral task
behavioral1
Sample
4f5f21f631c5cef1a070b2c974ded888_JaffaCakes118.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
4f5f21f631c5cef1a070b2c974ded888_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
4f5f21f631c5cef1a070b2c974ded888_JaffaCakes118
-
Size
159KB
-
MD5
4f5f21f631c5cef1a070b2c974ded888
-
SHA1
2b16642bf33950746c5efc54be97ed55d68c47ff
-
SHA256
2809928c2104e4034adfa165270bd8a0f804569fe612313a91c1b0b55e20271f
-
SHA512
602c1a1c3894bf3791e8da2505d2ef3980959454f45f61357a4a70aa7a8ea029a37b805331c6816b4f3b44bb581778e15da2439a718a6f0d11c088619276357c
-
SSDEEP
3072:eRbmfPyLePnYXOPHoDMd82HkqyHLRnFR+X/lMV:eRbmo+voOByHlFR+Plg
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4f5f21f631c5cef1a070b2c974ded888_JaffaCakes118
Files
-
4f5f21f631c5cef1a070b2c974ded888_JaffaCakes118.exe windows:5 windows x86 arch:x86
400616572e79b392753344e752ed557b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcessId
GetModuleFileNameA
CloseHandle
GetCommandLineA
CreateThread
CreateDirectoryA
GetPrivateProfileStringA
WritePrivateProfileStringA
GetTempPathA
LocalFree
lstrlenA
SetEndOfFile
CreateFileW
OutputDebugStringW
WriteConsoleW
FlushFileBuffers
SetStdHandle
GetStringTypeW
GetVersionExA
LCMapStringW
HeapReAlloc
LoadLibraryExW
GetModuleHandleW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
GetCurrentProcess
Sleep
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InterlockedDecrement
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetModuleFileNameW
GetStartupInfoW
DeleteCriticalSection
GetFileType
GetStdHandle
GetProcessHeap
GetConsoleCP
EncodePointer
DecodePointer
GetLastError
WideCharToMultiByte
RaiseException
RtlUnwind
IsDebuggerPresent
IsProcessorFeaturePresent
ExitProcess
GetModuleHandleExW
GetProcAddress
AreFileApisANSI
MultiByteToWideChar
HeapSize
HeapFree
HeapAlloc
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
ReadFile
GetConsoleMode
ReadConsoleW
SetFilePointerEx
WriteFile
user32
BeginPaint
PostQuitMessage
LoadCursorA
UpdateWindow
DispatchMessageA
PostMessageA
EndPaint
ShowWindow
GetMessageA
SetTimer
CreateDialogParamA
RegisterClassExA
KillTimer
LoadStringA
LoadIconA
SendMessageA
DestroyWindow
TranslateMessage
CreateWindowExA
TranslateAcceleratorA
GetDlgItem
DefWindowProcA
LoadAcceleratorsA
shell32
ord680
ShellExecuteExA
ole32
CoCreateInstance
CoInitializeSecurity
CoInitializeEx
CoUninitialize
CoSetProxyBlanket
oleaut32
VariantClear
SysFreeString
SysAllocString
comctl32
InitCommonControlsEx
wininet
InternetOpenUrlA
InternetCloseHandle
InternetOpenA
InternetReadFile
InternetQueryDataAvailable
rpcrt4
UuidToStringA
UuidCreate
RpcStringFreeA
shlwapi
PathRemoveFileSpecA
Sections
.text Size: 86KB - Virtual size: 86KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 30KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ