Static task
static1
Behavioral task
behavioral1
Sample
75640593eea0fba20dbb53c698a00ee0_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
75640593eea0fba20dbb53c698a00ee0_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
75640593eea0fba20dbb53c698a00ee0_JaffaCakes118
-
Size
667KB
-
MD5
75640593eea0fba20dbb53c698a00ee0
-
SHA1
b2310f04dea556ab23ca4bf147768482912173db
-
SHA256
f303135cecba127cfbf6461fab3edb6b5e6acd9edefcfdf027159cb51b26f501
-
SHA512
368bd34c12e3530f9ea447a29cb97e76261a7132117f4cf4bf3157f3eb02f24d3dc30b1d3220a86ff6a9d746d0b267c7f1fe8f2b3c7182dd52028909ef962804
-
SSDEEP
12288:JzR19lPGVObv0ZUJZSuJ8W5z73SZPsAviHdBzFGSalQnUpM4:9R19lPGVObvmYJysD9BzFUb
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 75640593eea0fba20dbb53c698a00ee0_JaffaCakes118
Files
-
75640593eea0fba20dbb53c698a00ee0_JaffaCakes118.exe windows:6 windows x86 arch:x86
c65ddf4083cf5d88cedfb7e82925052c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
StrCpyNW
netapi32
NetApiBufferFree
NetWkstaGetInfo
wininet
InternetCheckConnectionW
kernel32
SetWaitableTimer
LeaveCriticalSection
EnterCriticalSection
TlsFree
TlsAlloc
TlsSetValue
TlsGetValue
CloseHandle
WaitForSingleObject
SleepEx
SetEvent
CreateEventW
QueueUserAPC
TerminateThread
WaitForMultipleObjects
DeleteCriticalSection
CreateIoCompletionPort
InitializeCriticalSectionAndSpinCount
VerifyVersionInfoW
VerSetConditionMask
GetNativeSystemInfo
GetCurrentProcess
SetLastError
CopyFileW
lstrlenW
GetTempFileNameW
GetTickCount
CreateMutexW
CreateMutexA
ExitProcess
DeleteFileW
RemoveDirectoryW
AllocConsole
SetConsoleTextAttribute
GetStdHandle
WriteConsoleW
ReadConsoleInputW
FreeConsole
GetLocalTime
OpenEventW
InitializeCriticalSection
GetModuleHandleA
VirtualProtect
lstrcmp
GetModuleFileNameW
CreateProcessW
GetModuleHandleW
GetProcessHeap
GetQueuedCompletionStatus
PostQueuedCompletionStatus
MoveFileExW
GetTickCount64
GetLastError
SetStdHandle
ReadConsoleW
HeapSize
GlobalMemoryStatusEx
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
GetTimeZoneInformation
HeapReAlloc
ReadFile
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
HeapAlloc
HeapFree
WriteFile
SetEnvironmentVariableW
GetCommandLineW
GetCommandLineA
GetModuleHandleExW
ExitThread
RaiseException
RtlUnwind
LoadLibraryW
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
WideCharToMultiByte
DuplicateHandle
WaitForSingleObjectEx
Sleep
SwitchToThread
GetCurrentThread
GetCurrentThreadId
QueryPerformanceCounter
TryEnterCriticalSection
MultiByteToWideChar
CreateFileW
FindClose
FindFirstFileExW
FindNextFileW
SetFilePointerEx
AreFileApisANSI
EncodePointer
DecodePointer
GetSystemTimeAsFileTime
GetProcAddress
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
LocalFree
FormatMessageA
GetEnvironmentVariableW
GetFileAttributesW
DeviceIoControl
GetWindowsDirectoryW
ResetEvent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
CreateTimerQueue
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibrary
FreeLibraryAndExitThread
LoadLibraryExW
GetVersionExW
VirtualAlloc
VirtualFree
advapi32
RegDeleteValueW
CryptGenRandom
CryptReleaseContext
CryptAcquireContextW
RegDeleteTreeW
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
GetTokenInformation
OpenProcessToken
shell32
SHGetFolderPathAndSubDirW
ole32
CoInitializeSecurity
CoUninitialize
CoCreateGuid
StringFromGUID2
CoInitializeEx
CoCreateInstance
oleaut32
VariantInit
VariantClear
SysFreeString
SysAllocString
ws2_32
WSASetLastError
WSAGetLastError
closesocket
WSACleanup
getaddrinfo
freeaddrinfo
ioctlsocket
select
connect
shutdown
htonl
ntohl
htons
setsockopt
getsockopt
WSACloseEvent
WSAEventSelect
WSASocketW
WSAStartup
WSARecv
WSASend
WSACreateEvent
Sections
.text Size: 509KB - Virtual size: 509KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 115KB - Virtual size: 114KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 15KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
init Size: 512B - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ