Static task
static1
Behavioral task
behavioral1
Sample
7da8b9fc5c5a67a06afc0749473f1b6e_JaffaCakes118.exe
Resource
win7-20231129-en
General
-
Target
7da8b9fc5c5a67a06afc0749473f1b6e_JaffaCakes118
-
Size
3.8MB
-
MD5
7da8b9fc5c5a67a06afc0749473f1b6e
-
SHA1
7b0c1138015a3a573469e1142e44be65b73979c5
-
SHA256
bf0584009df2836bedf0ba3b0d499b1a8b2208bf59c85e6b12db123e9ccdafd7
-
SHA512
5b9a364aa7cdf6340e709afb5a60eabd045ace1eaeefaa23fd89ede50bd0a51329d69a4afd49ca270ebb80014882ef7728cf72a362a1d0a63d01ba66fa244df7
-
SSDEEP
49152:1J2hEqrEZnrd2HL7ZXzG7F9qvtHIZfhzUxD+S70ojNKj2CJ7EYkIFlxZe69jKLPg:rWslMHnxGSlH8q5Qj73kU1KLfw+GG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 7da8b9fc5c5a67a06afc0749473f1b6e_JaffaCakes118
Files
-
7da8b9fc5c5a67a06afc0749473f1b6e_JaffaCakes118.exe windows:5 windows x86 arch:x86
c68aa50862ba023855ebedae85aa9efb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetConsoleTextAttribute
GetEnvironmentStringsW
CancelWaitableTimer
GetModuleHandleW
GenerateConsoleCtrlEvent
GetConsoleAliasesA
IsBadReadPtr
GetSystemTimeAsFileTime
GetConsoleTitleA
CancelDeviceWakeupRequest
QueryActCtxW
CreateActCtxW
ActivateActCtx
GlobalAlloc
LoadLibraryW
GetCalendarInfoA
ReadFile
GetTimeZoneInformation
lstrlenW
LoadLibraryExW
GetStringTypeExA
GetCPInfoExW
GetLastError
GetProcAddress
AttachConsole
HeapUnlock
ResetEvent
BuildCommDCBAndTimeoutsW
SetConsoleCtrlHandler
LockResource
HeapLock
SetConsoleWindowInfo
GetModuleFileNameA
VirtualProtect
FindAtomW
QueryDepthSList
GetVolumeInformationW
lstrcpyA
WriteConsoleOutputW
TryEnterCriticalSection
CopyFileExW
SetDefaultCommConfigA
VirtualUnlock
HeapReAlloc
GetCommandLineW
HeapSetInformation
GetStartupInfoW
DecodePointer
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
TerminateProcess
GetCurrentProcess
IsProcessorFeaturePresent
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
RtlUnwind
HeapFree
CloseHandle
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
FreeEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetCurrentThread
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
SetFilePointer
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
Sleep
RaiseException
FatalAppExitA
CreateFileA
SetStdHandle
FlushFileBuffers
FreeLibrary
InterlockedExchange
GetLocaleInfoW
WriteConsoleW
MultiByteToWideChar
LCMapStringW
GetStringTypeW
HeapAlloc
SetEndOfFile
GetProcessHeap
HeapSize
CreateFileW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
gdi32
GetCharWidth32W
GetCharWidthFloatA
advapi32
GetSidSubAuthorityCount
RegQueryValueExW
Sections
.text Size: 3.8MB - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 46.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 34KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tipehul Size: 1024B - Virtual size: 963B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vati Size: 512B - Virtual size: 1B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.riyag Size: 512B - Virtual size: 1B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.yoz Size: 512B - Virtual size: 1B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 31KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ