Static task
static1
Behavioral task
behavioral1
Sample
82fb3b813bf6e7d81e2d77801966f1b6_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
82fb3b813bf6e7d81e2d77801966f1b6_JaffaCakes118
-
Size
3.8MB
-
MD5
82fb3b813bf6e7d81e2d77801966f1b6
-
SHA1
7c60d048b28306c148f3c70888482378e9b31912
-
SHA256
9b888c58cb69540da46bfa817e90e5b3337255c296a4007ba0ba2a41b321edb2
-
SHA512
5974cfe5b7c67252c304ee2fba89751d0c93c1514ae2a082f980a8ad15af92ce5e5c3215941280de1a01f648aa0b8c9b4dad55f1e43cd73c911f19518d4deced
-
SSDEEP
98304:/N5Vqa6g56H7GLkOw20BAt7GuODszgvCU+F4WwFr:VqDRH7rO30BAxODVK9F4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 82fb3b813bf6e7d81e2d77801966f1b6_JaffaCakes118
Files
-
82fb3b813bf6e7d81e2d77801966f1b6_JaffaCakes118.exe windows:5 windows x86 arch:x86
00194ad3028f201b964cf205b198e47f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
InterlockedIncrement
GetConsoleCP
GetPrivateProfileSectionW
SetEvent
DeleteCriticalSection
LocalUnlock
WriteFile
ReadFileEx
FindActCtxSectionStringA
SetFileShortNameW
GetFileAttributesA
ReleaseSemaphore
SleepEx
WaitForSingleObject
FindResourceExA
EndUpdateResourceA
GetConsoleTitleW
FreeConsole
SetConsoleTitleA
AttachConsole
ActivateActCtx
ReadConsoleW
ZombifyActCtx
ReleaseActCtx
HeapUnlock
HeapValidate
GetProcessHeaps
LoadLibraryA
LocalAlloc
GetProcAddress
CommConfigDialogW
HeapAlloc
GetCurrentProcess
lstrlenW
SetHandleInformation
GetModuleFileNameA
ResetEvent
ReadFile
InterlockedDecrement
Sleep
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
RaiseException
RtlUnwind
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
HeapFree
TerminateProcess
IsDebuggerPresent
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
SetFilePointer
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
ExitProcess
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapSize
VirtualAlloc
HeapReAlloc
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
InitializeCriticalSectionAndSpinCount
SetStdHandle
WideCharToMultiByte
CloseHandle
CreateFileA
LCMapStringA
LCMapStringW
GetConsoleMode
FlushFileBuffers
SetEndOfFile
GetProcessHeap
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
gdi32
GetCharWidthFloatW
advapi32
ReportEventW
Sections
.text Size: 86KB - Virtual size: 86KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 3.7MB - Virtual size: 77.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.kawigo Size: 27KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.yizaf Size: 1024B - Virtual size: 626B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.masenuh Size: 512B - Virtual size: 23B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pigufuc Size: 512B - Virtual size: 6B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.dikuhen Size: 1024B - Virtual size: 963B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 45KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ