Static task
static1
Behavioral task
behavioral1
Sample
9623a585daec05f3d2121996612af876_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
9623a585daec05f3d2121996612af876_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
9623a585daec05f3d2121996612af876_JaffaCakes118
-
Size
1.1MB
-
MD5
9623a585daec05f3d2121996612af876
-
SHA1
fbc1704f44a9db689ad7326981031488710067d1
-
SHA256
041edd9b07247086a4e378a7cc5dfd630f1c445e740c21f4140424cc1af35fe0
-
SHA512
328ade23c9616132aa1c491988562a95cddb409d7da7c3165c2130027702d2b49879eb5c32962612f2206a0ca871ad355a661b50293ab84c7398f64c61da0726
-
SSDEEP
24576:6BG4Aap+Ai7Dlzj/JRG2veDy8XhBsqgsSZbudmD7WNb:6fZr0lzTDy9xJApD7W1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9623a585daec05f3d2121996612af876_JaffaCakes118
Files
-
9623a585daec05f3d2121996612af876_JaffaCakes118.exe windows:5 windows x86 arch:x86
2b2014d405d30d3e46d1361b592a97f4
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WriteConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
GetThreadLocale
GetFileAttributesW
CreateDirectoryW
LoadLibraryExW
CreateEventW
FormatMessageW
GetSystemTime
CloseHandle
SetFilePointer
SetEndOfFile
ReleaseSemaphore
GetLastError
GetCurrentThreadId
GetCurrentProcess
VirtualAlloc
SetStdHandle
GetProcAddress
FlushFileBuffers
LCMapStringW
HeapSize
GetStringTypeW
HeapReAlloc
HeapAlloc
OutputDebugStringW
RtlUnwind
IsProcessorFeaturePresent
IsDebuggerPresent
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
HeapFree
LeaveCriticalSection
EnterCriticalSection
GetModuleHandleW
CreateFileW
GetCommandLineW
SetLastError
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
WideCharToMultiByte
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameW
WriteFile
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
secur32
FreeContextBuffer
userenv
LoadUserProfileW
ExpandEnvironmentStringsForUserW
crypt32
CertGetCertificateChain
CertNameToStrW
CryptAcquireCertificatePrivateKey
CryptExportPublicKeyInfo
CertControlStore
CertAddCertificateContextToStore
CertAddEncodedCertificateToStore
CertFreeCRLContext
CertGetCertificateContextProperty
CertCreateCertificateContext
CertEnumCertificatesInStore
CertOpenStore
CryptMsgGetParam
CryptEnumOIDInfo
CryptEncodeObjectEx
CryptStringToBinaryW
oleaut32
GetErrorInfo
SetErrorInfo
RegisterTypeLi
VarNot
VarNeg
VarBoolFromStr
VarBstrFromBool
VarBstrFromDate
VarBstrFromCy
VarCyFromStr
VarDateFromStr
VarR8FromStr
VarI4FromStr
VariantChangeType
VariantCopyInd
VariantCopy
VariantClear
VariantInit
SafeArrayPtrOfIndex
SafeArrayPutElement
SafeArrayGetElement
SafeArrayAccessData
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayRedim
SafeArrayCreate
SysFreeString
SysReAllocStringLen
SysAllocStringLen
CreateErrorInfo
Sections
.text Size: 95KB - Virtual size: 94KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 6.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.17rsr Size: 951KB - Virtual size: 951KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 99KB - Virtual size: 99KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ