Static task
static1
Behavioral task
behavioral1
Sample
693db3407f1860a4c511d34e30e6e512_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
693db3407f1860a4c511d34e30e6e512_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
693db3407f1860a4c511d34e30e6e512_JaffaCakes118
-
Size
329KB
-
MD5
693db3407f1860a4c511d34e30e6e512
-
SHA1
e3ba5adcefc08f8494d51277d5d514457e8f96b6
-
SHA256
23ba2d4a2ae7f6b7aa7db78d851a026a0ebdcf1b1b39ae18c3bcc74a2954e186
-
SHA512
274c65e2073d8997daa5c25f11c00e6af7add3dedd9347a225a7706e3b08f5f93529526ceadd5d4ea25f20bccadcce9a024f3f00f2dcb9d2b94fdb096d8c44b1
-
SSDEEP
6144:MV/cpm7L0zOSuBLbii5bkgVuN+xSKV7Wkrsf7LskpqS06oGYR9B1:MVEeLgfcXikbkgaISKVsoP9B1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 693db3407f1860a4c511d34e30e6e512_JaffaCakes118
Files
-
693db3407f1860a4c511d34e30e6e512_JaffaCakes118.exe windows:5 windows x86 arch:x86
d431b5037a9a54c9815e57ab3240c0f8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FreeLibrary
CreateDirectoryA
GetProcAddress
LoadLibraryA
SetEnvironmentVariableA
GetModuleFileNameA
FindResourceA
LoadResource
SizeofResource
LockResource
WaitForSingleObject
OpenProcess
GetExitCodeProcess
TerminateProcess
GetProcessId
CloseHandle
ReadFile
SetEndOfFile
CreateFileW
FlushFileBuffers
WriteConsoleW
SetStdHandle
SetFilePointerEx
OutputDebugStringW
HeapReAlloc
LoadLibraryExW
LCMapStringW
EncodePointer
DecodePointer
GetCommandLineA
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetLastError
SetLastError
GetCurrentThreadId
MultiByteToWideChar
ExitProcess
GetModuleHandleExW
AreFileApisANSI
WideCharToMultiByte
HeapSize
EnterCriticalSection
LeaveCriticalSection
HeapFree
RaiseException
HeapAlloc
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
WriteFile
GetModuleFileNameW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
RtlUnwind
GetConsoleCP
GetConsoleMode
GetStringTypeW
ReadConsoleW
shell32
SHFileOperationA
ord680
ShellExecuteExA
pdh
PdhMakeCounterPathA
PdhOpenQueryA
PdhAddCounterA
PdhGetRawCounterValue
PdhCollectQueryData
PdhCloseQuery
rpcrt4
RpcStringFreeA
UuidCreate
UuidToStringA
Sections
.text Size: 71KB - Virtual size: 70KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 214KB - Virtual size: 214KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ