Static task
static1
Behavioral task
behavioral1
Sample
9c36882766eaf3cb0a9318c9f791799f_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
9c36882766eaf3cb0a9318c9f791799f_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
9c36882766eaf3cb0a9318c9f791799f_JaffaCakes118
-
Size
5.6MB
-
MD5
9c36882766eaf3cb0a9318c9f791799f
-
SHA1
6d231fe1fffa57da9dd2a37437987a9d424a0531
-
SHA256
9a965646c0e396ff39f7b286b37dfb738e8bbedfc9912b5206c81a97b1c0648a
-
SHA512
5be57dddd5d585cf0b9ba46685646c654ac3cf5e11071aa4f089b2616748f4e504bf60b4197a587b74a112f94a7ab7f1e64c351969a65e7e31796ed8b76f396c
-
SSDEEP
24576:SrbDcKGJ8Kt5XBVvBMwTxFin7m2/MSbWxyWF9V9t4QJ1mBo57Bgh:SsW4JFK7z6zymS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9c36882766eaf3cb0a9318c9f791799f_JaffaCakes118
Files
-
9c36882766eaf3cb0a9318c9f791799f_JaffaCakes118.exe windows:5 windows x86 arch:x86
81414b093a8dbb756465290dec1cd0ad
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LockResource
GlobalAlloc
VirtualAllocEx
GetLastError
EnterCriticalSection
ReleaseSemaphore
LockFile
CloseHandle
MulDiv
GetSystemTime
GetSystemTimeAsFileTime
GetSystemInfo
TlsFree
CopyFileW
MoveFileW
OpenJobObjectW
IsValidCodePage
CompareStringW
GetConsoleWindow
EncodePointer
DecodePointer
RaiseException
RtlUnwind
GetCommandLineW
HeapAlloc
HeapFree
IsProcessorFeaturePresent
SetLastError
GetCurrentThread
GetCurrentThreadId
ExitProcess
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
WideCharToMultiByte
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameW
WriteFile
QueryPerformanceCounter
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
CreateEventW
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
GetTickCount
GetModuleHandleW
CreateSemaphoreW
LeaveCriticalSection
IsDebuggerPresent
GetACP
GetOEMCP
GetCPInfo
FreeLibrary
LoadLibraryExW
OutputDebugStringW
HeapReAlloc
GetStringTypeW
HeapSize
LCMapStringW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetStdHandle
SetFilePointerEx
WriteConsoleW
CreateFileW
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
VirtualProtect
VirtualFree
VirtualAlloc
GetVersionExW
GetModuleHandleA
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
DuplicateHandle
WaitForSingleObject
GetExitCodeThread
CreateThread
ExitThread
CreateTimerQueue
SetEvent
WaitForSingleObjectEx
SignalObjectAndWait
SwitchToThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
LoadLibraryW
user32
DestroyIcon
EnableScrollBar
ShowScrollBar
InvalidateRgn
SetWindowRgn
ShowOwnedPopups
GetDoubleClickTime
oleaut32
VarBstrFromDate
VarDateFromStr
VarI4FromStr
VariantCopyInd
VariantClear
SafeArrayPtrOfIndex
SafeArrayGetElement
SafeArrayUnaccessData
SafeArrayGetUBound
SysFreeString
Sections
.text Size: 175KB - Virtual size: 175KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 44KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 6.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.b6ht3 Size: 5.3MB - Virtual size: 5.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ