Static task
static1
Behavioral task
behavioral1
Sample
5c6a072ca1d9886e72b4789debcee8ad_JaffaCakes118.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
5c6a072ca1d9886e72b4789debcee8ad_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
5c6a072ca1d9886e72b4789debcee8ad_JaffaCakes118
-
Size
496KB
-
MD5
5c6a072ca1d9886e72b4789debcee8ad
-
SHA1
bd374eff233a6164531112010356b3e2009468da
-
SHA256
2b6a0653d5192a92b869caa0ebcd7fb2f954658f82fdf9fe1e3e8a4b73732b9e
-
SHA512
fa6df9077fff179b68d1b393ed555c1c323ef19cd608089cf5880880068dd45e3c89c4a9c0466d25b5ada3b0c94762c7e2f6b9d281c72af73998889464596e15
-
SSDEEP
12288:b+ey7msEzSMOiDbSiuhFGq+NeMvt6fDVy5Mvt6fDVy:DiZMOiDWi2Yeu0Iu0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5c6a072ca1d9886e72b4789debcee8ad_JaffaCakes118
Files
-
5c6a072ca1d9886e72b4789debcee8ad_JaffaCakes118.exe windows:5 windows x86 arch:x86
664906323665dd1938898891d03f4394
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Module32NextW
Module32FirstW
VirtualProtectEx
VirtualAllocEx
OpenProcess
WriteProcessMemory
VirtualProtect
lstrcmpiA
GetVersionExA
CreateProcessW
GetWindowsDirectoryW
GetCommandLineW
CopyFileW
GetModuleFileNameW
GetLastError
GetCurrentProcess
CreateMutexW
Process32NextW
Process32FirstW
GetTempPathW
SleepEx
SetEnvironmentVariableW
TerminateProcess
CreateThread
lstrcatW
lstrcpyW
ExitProcess
SetEndOfFile
HeapReAlloc
CreateFileW
FlushFileBuffers
SetStdHandle
WriteConsoleW
SetFilePointer
GetStringTypeW
HeapSize
OpenThread
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
LoadLibraryW
lstrcpyA
CloseHandle
Sleep
lstrlenW
ReadProcessMemory
GetModuleHandleW
GetProcAddress
GetCurrentProcessId
ReadFile
HeapSetInformation
GetStartupInfoW
RtlUnwind
SetUnhandledExceptionFilter
DecodePointer
WriteFile
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
HeapFree
HeapAlloc
RaiseException
IsProcessorFeaturePresent
UnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
GetProcessHeap
user32
CreateWindowExW
GetWindowLongW
SetWindowLongW
ShowWindow
GetMessageW
DispatchMessageW
SetWindowPos
RegisterClassExW
DefWindowProcW
PostQuitMessage
PeekMessageW
SendMessageW
UpdateWindow
advapi32
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerW
GetUserNameW
LookupPrivilegeNameW
GetTokenInformation
LookupAccountSidW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
SetServiceStatus
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
shlwapi
PathStripPathW
PathRemoveFileSpecW
PathAppendW
PathFileExistsW
Sections
.text Size: 207KB - Virtual size: 206KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 15KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 248KB - Virtual size: 247KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ