Static task
static1
Behavioral task
behavioral1
Sample
9ce68ab58140895c002c127254414250_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9ce68ab58140895c002c127254414250_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
9ce68ab58140895c002c127254414250_JaffaCakes118
-
Size
480KB
-
MD5
9ce68ab58140895c002c127254414250
-
SHA1
691c97b8ea9d9aa13c80cbf4b107aeb8fca7515a
-
SHA256
70f8e4d44eb5bc394c0ec47aadacf8e73f43b608ef65865ead7dcd1e14bd69a6
-
SHA512
a2d196d1116f6fdc2b3a1e41dff3453ac84348db09b7bf0e5391f19257096beb76c7c9a1622730ae8c4ead6fac3fc2f43e1a690d4d7b19bab88a4e47afed56a5
-
SSDEEP
6144:bbvTe6tY1N1yj644Jh/Vc6n+0gDlkcyLzzs2rOSjAf98mLCCLkZsqQoL4:bbre6tC1J/WkbzzseO7tJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9ce68ab58140895c002c127254414250_JaffaCakes118
Files
-
9ce68ab58140895c002c127254414250_JaffaCakes118.exe windows:4 windows x86 arch:x86
03ffb173446d67e9756c93a6d4c39a17
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
shell32
SHGetSpecialFolderLocation
SHChangeNotify
SHGetDesktopFolder
SHGetMalloc
SHBrowseForFolderW
SHGetPathFromIDListW
comctl32
ord17
version
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
kernel32
CreateFileA
WriteConsoleW
CreateThread
GetConsoleOutputCP
WriteConsoleA
GlobalUnlock
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
HeapSize
IsValidLocale
LoadLibraryW
LoadResource
LocalFileTimeToFileTime
LocalFree
LockResource
MapViewOfFile
MulDiv
IsDebuggerPresent
QueryDosDeviceW
RaiseException
ReadFile
RemoveDirectoryW
ResetEvent
ResumeThread
SetEndOfFile
SetErrorMode
SetEvent
SetFileAttributesW
SetFilePointer
SetFileTime
SetLastError
SetThreadLocale
SetThreadPriority
SizeofResource
Sleep
SuspendThread
SystemTimeToFileTime
TryEnterCriticalSection
UnmapViewOfFile
UpdateResourceW
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
VirtualQueryEx
WaitForMultipleObjectsEx
WaitForSingleObject
WideCharToMultiByte
WritePrivateProfileStringW
lstrlenW
CloseHandle
GetStdHandle
WriteFile
FindClose
FindFirstFileW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetCurrentThreadId
SwitchToThread
ExitThread
GetCommandLineA
GetStartupInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetHandleCount
GetFileType
RtlUnwind
GetProcAddress
GetModuleHandleA
GetModuleHandleW
ExitProcess
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetLastError
GetEnvironmentStringsW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
MultiByteToWideChar
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapReAlloc
LoadLibraryA
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetStdHandle
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
Sections
.gfids Size: 76KB - Virtual size: 72KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 380KB - Virtual size: 534KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ