Static task
static1
Behavioral task
behavioral1
Sample
9b9fa2d8cbca3ab72f4ff49b43a3e139_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
9b9fa2d8cbca3ab72f4ff49b43a3e139_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
9b9fa2d8cbca3ab72f4ff49b43a3e139_JaffaCakes118
-
Size
660KB
-
MD5
9b9fa2d8cbca3ab72f4ff49b43a3e139
-
SHA1
60db5df90f4d1ec75fc19523cf019076cc9ae94e
-
SHA256
f59486acaa39b01f92d6359356ff1f6031805fdd4c1d887805dfa3cc41bf4459
-
SHA512
620a48c961e54b158e9778dbd785a3ba00b2a0f0adb10b0f8081bd3adeaf1f5bf1be920748d94d347e61673da3981305ffa8ecdf78963e5ef9e24c0e45dc1ed8
-
SSDEEP
12288:V+zWh23Ks1mQnWattmsbMVSH05SxQiEQ9jmE56:V+zP3p0RzYa+E
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9b9fa2d8cbca3ab72f4ff49b43a3e139_JaffaCakes118
Files
-
9b9fa2d8cbca3ab72f4ff49b43a3e139_JaffaCakes118.exe windows:5 windows x86 arch:x86
e24946fd3b548d18411ea3dc85666a69
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegEnumKeyW
OpenEventLogW
ClearEventLogA
LogonUserW
InitializeAcl
CryptSignHashW
RegOpenKeyA
ControlService
RegReplaceKeyA
RegSaveKeyA
RegCreateKeyExA
RegUnLoadKeyA
authz
AuthzAddSidsToContext
AuthzInitializeContextFromSid
shlwapi
UrlIsNoHistoryW
PathIsRootW
UrlGetLocationW
UrlCombineW
PathCommonPrefixA
UrlIsOpaqueW
PathCompactPathW
PathAppendA
PathCombineA
UrlCompareW
PathIsURLW
UrlIsA
UrlHashW
UrlGetPartW
wtsapi32
WTSFreeMemory
WTSSetSessionInformationW
WTSVirtualChannelRead
WTSWaitSystemEvent
WTSRegisterSessionNotification
WTSQueryUserToken
WTSVirtualChannelPurgeInput
WTSQuerySessionInformationA
WTSSetUserConfigW
WTSEnumerateSessionsW
WTSEnumerateServersA
kernel32
WaitForSingleObject
CreateJobObjectW
GetProcAddress
GetStringTypeW
OpenJobObjectW
InitializeCriticalSection
GetCommandLineW
MoveFileA
GetModuleHandleA
GetTempPathA
ReadConsoleA
GetProfileSectionA
GetSystemDirectoryA
CreateMailslotA
CreateFileW
GetLogicalDriveStringsA
GetModuleFileNameW
UnmapViewOfFile
GetDateFormatA
GetVersion
LoadLibraryExA
GetExpandedNameA
lstrcmpiA
DeleteFileW
SearchPathW
GetTickCount
GetFileAttributesW
MoveFileExA
GetConsoleAliasA
Sections
.text Size: 48KB - Virtual size: 48KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
.data Size: 30KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 566KB - Virtual size: 566KB
IMAGE_SCN_MEM_READ