Static task
static1
Behavioral task
behavioral1
Sample
8fbc7a4f2713707ff8b1d3153af66250_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
8fbc7a4f2713707ff8b1d3153af66250_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
8fbc7a4f2713707ff8b1d3153af66250_JaffaCakes118
-
Size
343KB
-
MD5
8fbc7a4f2713707ff8b1d3153af66250
-
SHA1
8db6f98e94f4931a406eca7754d4f449d7d22922
-
SHA256
bb28eb7f44b52de18bac76a7b7d0e144cc03109fcdcd3e7d6f0792f0a5169a01
-
SHA512
aa35058fdc221f6b3107524e2e41635bbb4c90b9b8e0e0b005cbba6dd8639af317fb1fdef3ff8dcd707ec1170095cd045671fbe170894423764eb2e64cd5b5d2
-
SSDEEP
6144:9cA23YvEYJMU5e8mUrU/GdiE2r83K40xFA84PQW8u5PHgDhYOgBNjE8WBNjE8:903YvbJMEcE2I3p0xWQW82gD7Wj3wj3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8fbc7a4f2713707ff8b1d3153af66250_JaffaCakes118
Files
-
8fbc7a4f2713707ff8b1d3153af66250_JaffaCakes118.exe windows:5 windows x86 arch:x86
664906323665dd1938898891d03f4394
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Module32NextW
Module32FirstW
VirtualProtectEx
VirtualAllocEx
OpenProcess
WriteProcessMemory
VirtualProtect
lstrcmpiA
GetVersionExA
CreateProcessW
GetWindowsDirectoryW
GetCommandLineW
CopyFileW
GetModuleFileNameW
GetLastError
GetCurrentProcess
CreateMutexW
Process32NextW
Process32FirstW
GetTempPathW
SleepEx
SetEnvironmentVariableW
TerminateProcess
CreateThread
lstrcatW
lstrcpyW
ExitProcess
SetEndOfFile
HeapReAlloc
CreateFileW
FlushFileBuffers
SetStdHandle
WriteConsoleW
SetFilePointer
GetStringTypeW
HeapSize
OpenThread
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
LoadLibraryW
lstrcpyA
CloseHandle
Sleep
lstrlenW
ReadProcessMemory
GetModuleHandleW
GetProcAddress
GetCurrentProcessId
ReadFile
HeapSetInformation
GetStartupInfoW
RtlUnwind
SetUnhandledExceptionFilter
DecodePointer
WriteFile
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
HeapFree
HeapAlloc
RaiseException
IsProcessorFeaturePresent
UnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
GetProcessHeap
user32
CreateWindowExW
GetWindowLongW
SetWindowLongW
ShowWindow
GetMessageW
DispatchMessageW
SetWindowPos
RegisterClassExW
DefWindowProcW
PostQuitMessage
PeekMessageW
SendMessageW
UpdateWindow
advapi32
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerW
GetUserNameW
LookupPrivilegeNameW
GetTokenInformation
LookupAccountSidW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
SetServiceStatus
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
shlwapi
PathStripPathW
PathRemoveFileSpecW
PathAppendW
PathFileExistsW
Sections
.text Size: 203KB - Virtual size: 202KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 15KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 100KB - Virtual size: 99KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ