Static task
static1
Behavioral task
behavioral1
Sample
a8a91e019ed26398dc25902059e2a179_JaffaCakes118.exe
Resource
win7-20231129-en
General
-
Target
a8a91e019ed26398dc25902059e2a179_JaffaCakes118
-
Size
78KB
-
MD5
a8a91e019ed26398dc25902059e2a179
-
SHA1
336dafa0ae7272b5b653f2317a8c7ff7781144a1
-
SHA256
5438104f416bb8a85e3352871e0d05b137548134af616058ddb3f98bde0d1353
-
SHA512
bfc2cb233834e884b8d74482f187381e245d6834463e4a328c4fc6df7442a4edd210eb1d96ac30fff1386775046709d70a23710af79baa6b9228fcf7fc7cd681
-
SSDEEP
1536:NHSpKpOTyuNT8AEydsDW+35m0YT1VIdH/A50yswESN5YvGTwt3:NHSpKpO98Usy+35s/I9yswEnGU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a8a91e019ed26398dc25902059e2a179_JaffaCakes118
Files
-
a8a91e019ed26398dc25902059e2a179_JaffaCakes118.exe windows:5 windows x86 arch:x86
6177a2d2fac0863018f97756c8644bd3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
authz
AuthzFreeContext
AuthzAddSidsToContext
AuthzFreeAuditEvent
AuthzFreeResourceManager
AuthzInitializeContextFromSid
AuthzFreeResourceManager
AuthzAddSidsToContext
AuthzFreeContext
AuthzFreeAuditEvent
AuthzInitializeContextFromSid
kernel32
WriteProcessMemory
OpenEventW
MoveFileA
GetFileAttributesW
DecodePointer
InterlockedIncrement
GetACP
CreateEventW
GetModuleHandleA
OpenFileMappingA
GetEnvironmentVariableA
VirtualAlloc
GetEnvironmentVariableA
LoadLibraryExW
user32
LoadBitmapW
IsCharLowerA
MessageBoxExW
GetMessageA
MessageBoxW
CreateWindowExW
SetWindowTextW
GetWindow
InsertMenuW
FindWindowW
FindWindowW
GetFocus
shell32
ExtractIconW
DragQueryFileA
ShellMessageBoxA
ShellExecuteW
DragQueryPoint
FindExecutableA
SHEmptyRecycleBinA
FindExecutableA
SHDefExtractIconW
ShellAboutA
SHGetFileInfoA
SHGetDataFromIDListW
resutils
ClusWorkerTerminate
ResUtilDupString
certcli
CAEnumNextCA
CACloseCertType
advapi32
RegSaveKeyA
RegReplaceKeyA
IsValidSid
RegDeleteValueW
CryptSignHashA
ReadEventLogW
RegCreateKeyExW
RegUnLoadKeyA
IsValidAcl
InitializeAcl
OpenEventLogA
Sections
.text Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.jah Size: 67KB - Virtual size: 66KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE