Static task
static1
Behavioral task
behavioral1
Sample
8cf290ed04b25c37bbcb9b17686fa241_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8cf290ed04b25c37bbcb9b17686fa241_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
8cf290ed04b25c37bbcb9b17686fa241_JaffaCakes118
-
Size
2.0MB
-
MD5
8cf290ed04b25c37bbcb9b17686fa241
-
SHA1
5873f49123c357b7dbf77b5a81f5ce672079344c
-
SHA256
3d9b85e6178354bf752c6fe793420fd51975a5075e216e5247c8f6e5a0fd63e0
-
SHA512
80b362aaef912ed821e917d9bff4409b10636368e0ee4d8246ea8ff6e469dd1f7a08b1f5a0a6eb9d782c9521ec096d7ef32882697884202fc4c923810a7f9b1a
-
SSDEEP
24576:cZPYiV75Hr7vrvKfWFZnx1ZwqKoMfqapU2R2:c9YijvKeFZnxMlf1pP2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8cf290ed04b25c37bbcb9b17686fa241_JaffaCakes118
Files
-
8cf290ed04b25c37bbcb9b17686fa241_JaffaCakes118.exe windows:5 windows x86 arch:x86
d7e2bf086a446eb5b8bc8954fc8d9390
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCommandLineW
FindFirstFileExW
FindNextFileW
CopyFileExW
SetFileShortNameW
EnumUILanguagesW
CloseHandle
WriteConsoleW
GetFileTime
ExitProcess
VirtualAlloc
GlobalLock
GetACP
RtlUnwind
SetFilePointerEx
SetStdHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
LCMapStringW
HeapSize
HeapReAlloc
HeapAlloc
GetStringTypeW
OutputDebugStringW
LoadLibraryExW
RaiseException
EncodePointer
GetLastError
SetLastError
GetCurrentThreadId
DecodePointer
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
WideCharToMultiByte
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameW
WriteFile
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
IsProcessorFeaturePresent
IsDebuggerPresent
IsValidCodePage
GetOEMCP
GetCPInfo
EnterCriticalSection
LeaveCriticalSection
HeapFree
CreateFileW
winspool.drv
EnumFormsW
advapi32
RegQueryInfoKeyW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
OpenSCManagerW
user32
CloseDesktop
DispatchMessageW
RegisterClassW
IsZoomed
DdeFreeDataHandle
DrawIconEx
OffsetRect
SetPropW
DrawTextW
SetMenuDefaultItem
InsertMenuW
LoadAcceleratorsW
GetKeyboardType
ole32
ReleaseStgMedium
CoGetMalloc
wintrust
CryptCATAdminCalcHashFromFileHandle
Sections
.text Size: 100KB - Virtual size: 99KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 954KB - Virtual size: 7.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: 1024B - Virtual size: 724B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.t6tiat Size: 341KB - Virtual size: 341KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.dw12p5 Size: 278KB - Virtual size: 277KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.794s Size: 117KB - Virtual size: 117KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.loeer Size: 115KB - Virtual size: 114KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 100KB - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ