Static task
static1
Behavioral task
behavioral1
Sample
79ec0d810f12028105c8d0d1d0c92e33_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
79ec0d810f12028105c8d0d1d0c92e33_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
79ec0d810f12028105c8d0d1d0c92e33_JaffaCakes118
-
Size
1.4MB
-
MD5
79ec0d810f12028105c8d0d1d0c92e33
-
SHA1
033efdd5f7eed3ca5c9d7f4e52caf882b56279bd
-
SHA256
3bb0ca0df359b61abc67072f3691bd6e8281837f3656ae40c7275740b110ccc3
-
SHA512
8af6ccdc990024af599f0b579d83cdb27ee704dad41fb0b522449e7379bd0f6e69a1826865b2d324b36ec56e7ccc99f4de5d6198af08e2d2add5be935ba1a09e
-
SSDEEP
24576:ebs+ydUH+dvzGCryVJW2AjVFJTj8oI7NSHq8xO1:ksndUedqowgvBmPgO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 79ec0d810f12028105c8d0d1d0c92e33_JaffaCakes118
Files
-
79ec0d810f12028105c8d0d1d0c92e33_JaffaCakes118.exe windows:6 windows x86 arch:x86
b6d9005afde7b09c9c44803c9f862332
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
HeapAlloc
GetProcessHeap
HeapFree
TlsAlloc
GetLastError
EnterCriticalSection
LeaveCriticalSection
WaitForSingleObject
CloseHandle
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
WaitForMultipleObjects
TerminateThread
QueueUserAPC
PostQueuedCompletionStatus
CreateIoCompletionPort
SetWaitableTimer
GetQueuedCompletionStatus
SetLastError
VerSetConditionMask
VerifyVersionInfoW
CreateSemaphoreA
CreateEventA
ReleaseSemaphore
WaitForSingleObjectEx
WaitForMultipleObjectsEx
VirtualAlloc
TlsGetValue
TlsSetValue
TlsFree
WriteConsoleW
CreateFileW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
HeapReAlloc
HeapSize
GetStringTypeW
SetStdHandle
GetFileType
WideCharToMultiByte
CreateEventW
SwitchToThread
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
SetEvent
ResetEvent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
FormatMessageA
LocalFree
QueryPerformanceFrequency
OpenEventA
Sleep
ResumeThread
GetModuleHandleA
CreateWaitableTimerA
RtlUnwind
RaiseException
EncodePointer
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
GetStdHandle
WriteFile
CreateThread
ExitThread
FreeLibraryAndExitThread
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
DecodePointer
user32
GetWindowModuleFileNameW
shell32
ord98
ord90
ord167
Shell_GetCachedImageIndexW
DragFinish
DoEnvironmentSubstW
ole32
OleInitialize
ws2_32
WSAStartup
WSACleanup
Sections
.text Size: 217KB - Virtual size: 216KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 42KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ