Static task
static1
Behavioral task
behavioral1
Sample
85ec91fb6abc63cf6287513a4c25e2cb_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
85ec91fb6abc63cf6287513a4c25e2cb_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
85ec91fb6abc63cf6287513a4c25e2cb_JaffaCakes118
-
Size
2.9MB
-
MD5
85ec91fb6abc63cf6287513a4c25e2cb
-
SHA1
f122759bf49c9255c6276ee61bb9702fbc10bd78
-
SHA256
d7c6acf93c581e5a97459399c16dbf7c9f7c61187f39c6cc27e492a33472df6f
-
SHA512
d1ce1f661466ca1eedcd4a97ef955f6bd0fa01e89b35230ecc5698f24f7ea0443880a5496f32fdeaa1555e30ec72ef4d58991213940fed7529a58c1bf782d7ca
-
SSDEEP
24576:SccBHJIQKuvzCeOXh+Yq0l2PfZvd17QjRurYekF1r6cy0LicLznTN4rQQxkITyzx:Lhm9SMHNQFu0VTN4rQtg/qZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 85ec91fb6abc63cf6287513a4c25e2cb_JaffaCakes118
Files
-
85ec91fb6abc63cf6287513a4c25e2cb_JaffaCakes118.exe windows:5 windows x86 arch:x86
43fb3770b61724be0ebfd9fc02f611f5
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
userenv
UnregisterGPNotification
RegisterGPNotification
LeaveCriticalPolicySection
EnterCriticalPolicySection
ExpandEnvironmentStringsForUserW
GetUserProfileDirectoryW
LoadUserProfileW
crypt32
CertFreeCRLContext
CertFreeCertificateChain
CryptProtectData
CertGetNameStringW
CryptAcquireCertificatePrivateKey
CryptExportPublicKeyInfo
CryptHashCertificate
CertAddEncodedCertificateToStore
kernel32
LoadLibraryW
GetStringTypeW
SetStdHandle
WriteConsoleW
CreateFileW
GetLogicalProcessorInformation
SetFilePointerEx
GetVersion
VirtualAlloc
HeapDestroy
GetLastError
TlsAlloc
TlsFree
FindNextFileW
CloseHandle
DuplicateHandle
WaitForSingleObject
GetCurrentProcess
GetCurrentThread
GetCurrentThreadId
GetExitCodeThread
GetSystemTimeAsFileTime
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
RaiseException
RtlUnwind
GetCommandLineW
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
Sleep
TerminateProcess
TlsGetValue
TlsSetValue
GetStartupInfoW
GetTickCount
GetModuleHandleW
GetProcAddress
CreateSemaphoreW
CreateThread
ExitThread
LoadLibraryExW
HeapFree
CreateTimerQueue
SetEvent
WaitForSingleObjectEx
SignalObjectAndWait
SwitchToThread
SetThreadPriority
GetThreadPriority
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
HeapAlloc
IsDebuggerPresent
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
WideCharToMultiByte
GetProcessHeap
GetStdHandle
GetFileType
GetModuleFileNameW
WriteFile
QueryPerformanceCounter
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapSize
OutputDebugStringW
GetThreadTimes
FreeLibrary
FreeLibraryAndExitThread
GetModuleHandleA
GetVersionExW
VirtualFree
VirtualProtect
ReleaseSemaphore
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
HeapReAlloc
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
LCMapStringW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
Sections
.text Size: 187KB - Virtual size: 186KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 44KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2.6MB - Virtual size: 10.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 14KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ