Static task
static1
Behavioral task
behavioral1
Sample
8c7ebd739990c20d34ee9da707747bc2_JaffaCakes118.exe
Resource
win7-20240508-en
General
-
Target
8c7ebd739990c20d34ee9da707747bc2_JaffaCakes118
-
Size
132KB
-
MD5
8c7ebd739990c20d34ee9da707747bc2
-
SHA1
f489878f1ea6b00221cb168b749764b5ebb9d364
-
SHA256
75ace839beaa44438502a83dbd2aed5ab8c206700c63a20d1e1425228fc29bf4
-
SHA512
2533fa3fd68e5e31b27d748518004697deed40b8591fcc57edaba6721f21d3cf6175b2c19bc50da7fcf261fb932dee02a1d0105e9749099241bbeb07ebc5b966
-
SSDEEP
3072:LZ/7FQbks58kW7FJBbUBxO7e8wxWLvJAEDO1Al+QQb:LZc5GrZJJUB0e8wyBpa1Ap
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8c7ebd739990c20d34ee9da707747bc2_JaffaCakes118
Files
-
8c7ebd739990c20d34ee9da707747bc2_JaffaCakes118.exe windows:6 windows x86 arch:x86
1dd4c32efb5d5113fc462dbafbdb1683
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mprapi
MprAdminMIBEntryCreate
MprAdminTransportGetInfo
advapi32
StartServiceW
GetSecurityDescriptorGroup
GetSidSubAuthority
CryptImportKey
CryptSignHashW
ObjectOpenAuditAlarmA
AddUsersToEncryptedFile
kernel32
DisconnectNamedPipe
DeleteTimerQueueEx
ScrollConsoleScreenBufferA
GetCommandLineW
SetConsoleHistoryInfo
GetCurrentProcess
GetProcessId
GetLocalTime
CloseHandle
HeapFree
Thread32First
SetVolumeLabelW
GetPriorityClass
PeekConsoleInputA
winscard
SCardEstablishContext
rpcrt4
RpcBindingInqAuthClientW
RpcIfInqId
RpcMgmtIsServerListening
winspool.drv
FindClosePrinterChangeNotification
netapi32
NetGroupSetUsers
NetSessionGetInfo
gdi32
SetPixel
GetTextColor
CreatePenIndirect
CreateFontW
CreateRectRgnIndirect
shlwapi
UrlIsW
user32
GetScrollPos
GetWindowTextLengthW
IsZoomed
GetForegroundWindow
GetScrollRange
ChangeDisplaySettingsW
GetCapture
MoveWindow
oleaut32
VarParseNumFromStr
DispCallFunc
msacm32
acmStreamOpen
winmm
midiOutMessage
wininet
InternetCrackUrlA
comctl32
ImageList_AddMasked
Sections
.text Size: 16KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.x Size: 40KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.qdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.code Size: 52KB - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 912B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ