Static task
static1
Behavioral task
behavioral1
Sample
7b2795e73c3d64deb1f11262e2462c39_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
7b2795e73c3d64deb1f11262e2462c39_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
7b2795e73c3d64deb1f11262e2462c39_JaffaCakes118
-
Size
2.4MB
-
MD5
7b2795e73c3d64deb1f11262e2462c39
-
SHA1
7b1352e191927ea487e674b4e07c206ce9d19963
-
SHA256
76bf947e443d1aaa892a318fdc74ae73dec34ba812bd1f7c8876b2124545c5d1
-
SHA512
f420370b9add4b483b22fbacb33160f249f1c4fd93cf40805a99a69e4ae232861981434350fdcf76e0bbb9f9fb13f7a90ab639685a677fc352e1d1379bd52551
-
SSDEEP
24576:JoGCnCaDVTllw5IpH+hDaun3l9UYtme/UKU7NDBO:JoGCnCCRlhEau3lAo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7b2795e73c3d64deb1f11262e2462c39_JaffaCakes118
Files
-
7b2795e73c3d64deb1f11262e2462c39_JaffaCakes118.exe windows:5 windows x86 arch:x86
40122a10e07af5d4c333f3207fd2bf2c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetConsoleWindow
EnumSystemCodePagesW
GetUserGeoID
GetLocaleInfoW
FindNextFileW
GetTempPathW
FileTimeToSystemTime
GetLocalTime
GetFileSize
GetFileType
FreeEnvironmentStringsW
VirtualAlloc
GlobalFree
CloseHandle
WriteConsoleW
SetFilePointerEx
SetStdHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
LCMapStringW
HeapSize
HeapReAlloc
HeapAlloc
GetStringTypeW
OutputDebugStringW
RtlUnwind
LoadLibraryExW
HeapFree
LeaveCriticalSection
EnterCriticalSection
GetCPInfo
GetCommandLineW
RaiseException
EncodePointer
GetLastError
SetLastError
GetCurrentThreadId
DecodePointer
ExitProcess
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
WideCharToMultiByte
GetProcessHeap
GetStdHandle
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameW
WriteFile
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
IsProcessorFeaturePresent
IsDebuggerPresent
IsValidCodePage
GetACP
GetOEMCP
CreateFileW
advapi32
RegOpenKeyExW
RegEnumValueW
RegEnumKeyExW
RegQueryInfoKeyW
crypt32
CertFindExtension
CryptHashCertificate
CertGetPublicKeyLength
CertSetCertificateContextProperty
CryptHashPublicKeyInfo
CertCloseStore
CryptMsgGetParam
CryptDecodeObject
CryptProtectData
CryptStringToBinaryW
CryptBinaryToStringW
CertCreateCertificateContext
user32
GetCursorInfo
MonitorFromWindow
CreateIconIndirect
LoadBitmapW
GetWindow
FindWindowExW
InflateRect
SetRect
DrawFocusRect
GetSysColor
GetWindowTextLengthW
InvalidateRect
GetActiveWindow
IsCharAlphaNumericW
SendDlgItemMessageW
SetDlgItemInt
IsIconic
DeferWindowPos
DestroyWindow
DefWindowProcW
PostMessageW
GetMessageTime
ActivateKeyboardLayout
GetClientRect
mpr
WNetGetLastErrorW
WNetGetConnectionW
Sections
.text Size: 141KB - Virtual size: 141KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1019KB - Virtual size: 7.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: 1024B - Virtual size: 724B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.atca Size: 292KB - Virtual size: 291KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.cete Size: 319KB - Virtual size: 319KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.nyd1 Size: 135KB - Virtual size: 135KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.iegoo Size: 136KB - Virtual size: 136KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 363KB - Virtual size: 362KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ