Static task
static1
Behavioral task
behavioral1
Sample
a0023f1d35f686ac0baff1b0b041d849_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
a0023f1d35f686ac0baff1b0b041d849_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
a0023f1d35f686ac0baff1b0b041d849_JaffaCakes118
-
Size
1.5MB
-
MD5
a0023f1d35f686ac0baff1b0b041d849
-
SHA1
fc4bc3338303ae8fb6ea942aed72f49bd7c11679
-
SHA256
8fbcec1f3488db497bdaef7cd6d9dcc52a8e0f3c996151f55e1489e4706766ee
-
SHA512
55423d063ae9026ca8d9498a35f02653b27e2202d0f1396e0337aa5e2013531b656e1db9e679ea7f66a9234b00e1b471b382c758768072dfa71e5a4591f5f8f6
-
SSDEEP
24576:7AApQjMP64BF620JWns4ldzx/d0bMMgLtjz3TrZkPgzV8y38Ph32W/BmOghQ:kqQjMi4BoLJWXli7a1r4/y38P4AEOsQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a0023f1d35f686ac0baff1b0b041d849_JaffaCakes118
Files
-
a0023f1d35f686ac0baff1b0b041d849_JaffaCakes118.exe windows:6 windows x86 arch:x86
951a59442943b763fa1b8661c3223952
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
wtsapi32
WTSQueryUserToken
userenv
CreateEnvironmentBlock
kernel32
GetTimeZoneInformation
LocalFree
AreFileApisANSI
ReadFile
TryEnterCriticalSection
HeapCreate
HeapFree
EnterCriticalSection
GetFullPathNameW
WriteFile
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
LeaveCriticalSection
InitializeCriticalSection
SetFilePointer
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateMutexW
WaitForSingleObject
CreateFileW
GetFileAttributesW
GetCurrentThreadId
UnmapViewOfFile
HeapValidate
HeapSize
Sleep
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
CreateFileA
WaitForSingleObjectEx
DeleteFileW
HeapReAlloc
GetSystemInfo
LoadLibraryW
HeapAlloc
HeapCompact
HeapDestroy
UnlockFile
LockFileEx
GetFileSize
DeleteCriticalSection
GetCurrentProcessId
GetProcessHeap
SystemTimeToFileTime
FreeLibrary
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
GetTickCount
FlushFileBuffers
CopyFileA
WriteConsoleW
LoadLibraryA
GetFileAttributesA
GetLastError
MultiByteToWideChar
lstrcmpA
FindClose
FindNextFileA
GetCurrentProcess
FindFirstFileA
GetModuleFileNameA
ReadConsoleInputW
WideCharToMultiByte
SetConsoleMode
SetStdHandle
WTSGetActiveConsoleSessionId
GetProcAddress
DeleteFileA
SetLastError
InitializeCriticalSectionAndSpinCount
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
EncodePointer
DecodePointer
GetCPInfo
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
GetStdHandle
GetFileType
GetModuleHandleA
GlobalMemoryStatus
FlushConsoleInputBuffer
RtlUnwind
RaiseException
LoadLibraryExW
ExitProcess
GetModuleHandleExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleFileNameW
SetConsoleCtrlHandler
GetConsoleCP
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetConsoleMode
ReadConsoleW
SetFilePointerEx
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
CloseHandle
user32
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxA
advapi32
RegCloseKey
RegisterEventSourceA
DeregisterEventSource
AdjustTokenPrivileges
CreateProcessAsUserA
SetTokenInformation
LookupPrivilegeValueA
OpenProcessToken
DuplicateTokenEx
GetTokenInformation
ReportEventA
RegGetValueA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
shell32
ShellExecuteExA
crypt32
CryptUnprotectData
Sections
.text Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 273KB - Virtual size: 272KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 13KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 1000B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 47KB - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ