Static task
static1
Behavioral task
behavioral1
Sample
9d7fed273d5b291e357cbd5740f3d80e_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9d7fed273d5b291e357cbd5740f3d80e_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
9d7fed273d5b291e357cbd5740f3d80e_JaffaCakes118
-
Size
1.2MB
-
MD5
9d7fed273d5b291e357cbd5740f3d80e
-
SHA1
0e545a043552e102ea5404ecddf1cdb0297b64ac
-
SHA256
e01e2155fe9248c76ab28b1d490cc40cfedfddcc61400015df300a89c6876a18
-
SHA512
4c6a8119002e7a9c9bf7b7346de9ee5eb7a93b39c6934a255abc467b88c9012180930c39398cb34c0f784d972ebe1e4861aa0432782ab269da90bb3ce0d43f62
-
SSDEEP
24576:Uki2SU2Q22yLGTyljJmfGvKtZ3dwm5+thyAOerWiI:UXU2Q2XljAfGv2dhctQAQ9
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9d7fed273d5b291e357cbd5740f3d80e_JaffaCakes118
Files
-
9d7fed273d5b291e357cbd5740f3d80e_JaffaCakes118.exe windows:5 windows x86 arch:x86
37118f8837c5511b9f3170e51dd8162b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ole32
CreateStreamOnHGlobal
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CLSIDFromProgID
kernel32
WriteFile
WriteConsoleW
SetFilePointerEx
SetStdHandle
GetConsoleMode
GetConsoleCP
GetProcAddress
GetVersion
VirtualAlloc
GetCurrentThreadId
GetLastError
ReleaseSemaphore
WaitForMultipleObjects
CloseHandle
MulDiv
GetSystemTime
GetSystemTimeAsFileTime
GetLocalTime
FileTimeToLocalFileTime
CreateFileMappingW
LoadLibraryW
GetModuleHandleW
OutputDebugStringW
FindResourceW
DeleteFileW
QueryPerformanceCounter
MultiByteToWideChar
LCMapStringW
GetLocaleInfoW
FlushFileBuffers
GetCommandLineW
SetLastError
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
WideCharToMultiByte
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameW
CreateFileW
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EnterCriticalSection
LeaveCriticalSection
HeapFree
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
IsDebuggerPresent
IsProcessorFeaturePresent
LoadLibraryExW
RtlUnwind
HeapAlloc
HeapReAlloc
GetStringTypeW
HeapSize
secur32
TranslateNameW
Sections
.text Size: 72KB - Virtual size: 71KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1016KB - Virtual size: 1016KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 6.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 147KB - Virtual size: 147KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ