Static task
static1
Behavioral task
behavioral1
Sample
860b29dda2616be5e14abb7936dcc2a2_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
860b29dda2616be5e14abb7936dcc2a2_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
860b29dda2616be5e14abb7936dcc2a2_JaffaCakes118
-
Size
89KB
-
MD5
860b29dda2616be5e14abb7936dcc2a2
-
SHA1
433292789048c32658ac1d235422bcf4bf3f0a89
-
SHA256
0c82747ec798a776e8cf15d8dcdaacb7aa363a7c56d5b27e21724dde27b55ce5
-
SHA512
5c0d7f4d6b59e4a34dabc8a55bac850a90271e70e79ca3191c91cd9002f7cc5081f4371c5dcc40bed9ce31fbb154be0fba2f5cfe33dbff5a2ada7bb0832874d5
-
SSDEEP
1536:gTXKMIpHScs0Kex2upYK7CzJ/4AKbDv7M6rTwvW1Yoj1mplc/o8LKiPWGPMlJBC0:Q7Ih/s0FYK7CJgv7M6rTwvMYS16cvLDi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 860b29dda2616be5e14abb7936dcc2a2_JaffaCakes118
Files
-
860b29dda2616be5e14abb7936dcc2a2_JaffaCakes118.exe windows:5 windows x86 arch:x86
51aefcf2f88b66370f5ded8f08acc100
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryW
CreateThread
HeapReAlloc
HeapAlloc
HeapFree
GetProcessHeap
GetModuleHandleA
IsBadReadPtr
VirtualAllocEx
GetEnvironmentVariableW
CreateProcessW
GetComputerNameA
GetDriveTypeW
FreeLibrary
InterlockedIncrement
GetLogicalDrives
InterlockedExchange
InterlockedExchangeAdd
GetExitCodeThread
WideCharToMultiByte
MultiByteToWideChar
CreateMutexW
OpenMutexW
ReleaseMutex
SetLastError
SystemTimeToFileTime
GetSystemTime
GetVolumeNameForVolumeMountPointW
GetCurrentProcess
DeleteFileW
FindNextFileW
RemoveDirectoryW
FindClose
VirtualAlloc
GetTempPathW
ReadFile
WriteFile
VirtualFree
FindFirstFileW
GetFileSize
GetLastError
GetTickCount
CreateFileW
SetEvent
CreateDirectoryW
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
OpenProcess
CreateRemoteThread
GetProcAddress
SetThreadPriority
GetFileAttributesW
GetCurrentThread
SetFileAttributesW
WriteProcessMemory
LocalFree
GetCurrentProcessId
CloseHandle
DuplicateHandle
CreateEventW
GetModuleFileNameW
Sleep
VirtualFreeEx
GetModuleHandleW
WaitForSingleObject
GetCommandLineW
SetFilePointer
ExitProcess
user32
CharUpperW
CharToOemW
advapi32
SetSecurityDescriptorSacl
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
InitiateSystemShutdownExW
AdjustTokenPrivileges
LookupPrivilegeValueW
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
OpenProcessToken
RevertToSelf
ImpersonateSelf
GetFileSecurityW
AccessCheck
MapGenericMask
OpenThreadToken
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptCreateHash
CryptEncrypt
CryptImportKey
CryptReleaseContext
CryptSetKeyParam
CryptAcquireContextW
CryptGetHashParam
GetLengthSid
shlwapi
PathMatchSpecW
PathFindExtensionW
PathAppendW
PathStripPathW
SHDeleteValueW
PathSkipRootW
wvnsprintfA
PathAddBackslashW
PathAddExtensionW
PathCombineW
PathRemoveBackslashW
StrCmpNIW
PathUnquoteSpacesW
PathRemoveFileSpecW
wvnsprintfW
ole32
StringFromGUID2
CLSIDFromString
shell32
CommandLineToArgvW
SHGetFolderPathW
ShellExecuteW
crypt32
CryptStringToBinaryW
CryptDecodeObjectEx
wininet
InternetCrackUrlA
InternetCloseHandle
HttpQueryInfoA
InternetConnectA
InternetReadFile
InternetSetOptionA
HttpOpenRequestA
HttpSendRequestA
InternetOpenA
InternetQueryOptionA
Sections
.text Size: 34KB - Virtual size: 33KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ