Static task
static1
Behavioral task
behavioral1
Sample
5d568a9de60d5265370f58305f1d942d_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
5d568a9de60d5265370f58305f1d942d_JaffaCakes118
-
Size
400KB
-
MD5
5d568a9de60d5265370f58305f1d942d
-
SHA1
b249a7bbda785a1194c6a40699439a639a806521
-
SHA256
767bfbc1a25997de2d6203b7ec79afe012f1049eda612efb5c51e4da68972b58
-
SHA512
0e80dbcc822ec875eed248ca62a587ca146ada754a85decf4ac833b76a6c2a909719d5479b5ab721bcd14a599ebdfdef7f456d8007f5eb8d9b6e1b57584dd227
-
SSDEEP
6144:g68gSfhk7ElpHrVbUWGDctV7GhmER2a+RspHaLp5j1mcY3mEDm8I0:g68gOhYyHrVdGU1GhmhRsuRY3fw0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5d568a9de60d5265370f58305f1d942d_JaffaCakes118
Files
-
5d568a9de60d5265370f58305f1d942d_JaffaCakes118.exe windows:5 windows x86 arch:x86
d1a8c376c79e8854a66f8db1f0af27d7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
rpcrt4
NdrGetUserMarshalInfo
kernel32
ExpandEnvironmentStringsW
GetConsoleMode
DebugActiveProcess
GetCommTimeouts
LoadLibraryExA
lstrcpyA
GetLocaleInfoW
DeleteCriticalSection
FindAtomA
GetThreadContext
GetVolumeInformationA
GetDriveTypeA
GetEnvironmentVariableW
GetCommandLineA
GetVersionExA
GetStartupInfoA
HeapAlloc
SetUnhandledExceptionFilter
GetProcAddress
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetLastError
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetCurrentThreadId
GetCurrentThread
HeapDestroy
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetTickCount
GetTempPathW
GetSystemTimeAsFileTime
SetFilePointer
OutputDebugStringA
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
FatalAppExitA
VirtualAlloc
HeapReAlloc
SetConsoleCtrlHandler
FreeLibrary
InterlockedExchange
InitializeCriticalSection
Sleep
RtlUnwind
SetStdHandle
GetConsoleCP
FlushFileBuffers
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
UnhandledExceptionFilter
TerminateProcess
GetCurrentProcess
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
VirtualProtect
GetSystemInfo
VirtualQuery
GetTimeZoneInformation
CloseHandle
CreateFileA
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetWindowsDirectoryA
GetThreadSelectorEntry
GetCurrentDirectoryW
FillConsoleOutputCharacterW
DeleteVolumeMountPointW
LoadLibraryA
GetModuleHandleA
GetCurrentProcessId
user32
GetKeyboardLayoutNameA
GetKeyboardState
GetClassInfoExA
FindWindowExW
GetCursorInfo
DialogBoxParamW
LockWorkStation
version
GetFileVersionInfoW
comdlg32
GetOpenFileNameW
GetSaveFileNameW
advapi32
LookupAccountNameA
FreeEncryptionCertificateHashList
gdi32
GetFontUnicodeRanges
Escape
GetRgnBox
Sections
.text Size: 116KB - Virtual size: 113KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256KB - Virtual size: 254KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ