Static task
static1
Behavioral task
behavioral1
Sample
61d6c2e3ede924c3d0c12e4094feab91_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
61d6c2e3ede924c3d0c12e4094feab91_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
61d6c2e3ede924c3d0c12e4094feab91_JaffaCakes118
-
Size
1.4MB
-
MD5
61d6c2e3ede924c3d0c12e4094feab91
-
SHA1
6e3ac8f6b5602ae0fede93a2500de5126873569d
-
SHA256
2fcfbc8d14920e8fb7e699aef975fb9603117344147089abe3a76def149ed4a2
-
SHA512
e1289b7bdf9e78dd27009956c090e9796ea1538444d4447f3b403d170418e01134dbf1cf25d4b1c880d457bffd7335c4812d288c2dd0358dc0ece7c39f9dd161
-
SSDEEP
24576:QKTTLZTUuNiVwtnbKqPW8fZyiuZcygKQtxwXwIqWzG:Q4PZTV1xb48RyiosIwOG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 61d6c2e3ede924c3d0c12e4094feab91_JaffaCakes118
Files
-
61d6c2e3ede924c3d0c12e4094feab91_JaffaCakes118.exe windows:5 windows x86 arch:x86
43ad292870ac9d996738bfaa052d114e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FindResourceExW
FindFirstFileW
FindNextFileW
CompareStringW
GetThreadLocale
WriteConsoleW
SetFilePointerEx
SetStdHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
LCMapStringW
CreateProcessW
HeapSize
GetStringTypeW
HeapReAlloc
HeapAlloc
OutputDebugStringW
RtlUnwind
LoadLibraryExW
IsProcessorFeaturePresent
IsDebuggerPresent
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
HeapFree
CreateFileMappingW
TlsAlloc
CloseHandle
FindClose
WaitForSingleObject
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetLastError
GetCurrentThreadId
VirtualAlloc
LocalFree
GlobalLock
GetCommandLineW
SetLastError
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
WideCharToMultiByte
GetProcessHeap
GetStdHandle
GetFileType
GetStartupInfoW
GetModuleFileNameW
WriteFile
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
CreateFileW
ole32
PropVariantClear
CoTaskMemRealloc
CLSIDFromProgID
CLSIDFromString
StringFromCLSID
ReleaseStgMedium
oleaut32
SetErrorInfo
RegisterTypeLi
LoadTypeLi
VarNot
VarNeg
VarBstrFromBool
VarBstrFromDate
VarBstrFromCy
VarDateFromStr
VarI4FromStr
VariantChangeTypeEx
VariantCopy
VariantClear
SafeArrayPutElement
SafeArrayGetElement
SafeArrayUnaccessData
SafeArrayGetLBound
SafeArrayRedim
SafeArrayCreate
SysStringLen
SysFreeString
SysReAllocStringLen
SysAllocStringLen
comctl32
CreateToolbarEx
ImageList_Write
ImageList_DragShowNolock
ImageList_DragEnter
ImageList_EndDrag
ImageList_GetIcon
ImageList_DrawIndirect
ImageList_AddMasked
ImageList_Replace
ImageList_Draw
ImageList_SetImageCount
InitCommonControlsEx
_TrackMouseEvent
Sections
.text Size: 80KB - Virtual size: 80KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 7.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.etd7 Size: 1004KB - Virtual size: 1003KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 362KB - Virtual size: 361KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ