Static task
static1
Behavioral task
behavioral1
Sample
a9dd5607f44c6b5553f522cecdc7ec08_JaffaCakes118.exe
Resource
win7-20240508-en
General
-
Target
a9dd5607f44c6b5553f522cecdc7ec08_JaffaCakes118
-
Size
3.8MB
-
MD5
a9dd5607f44c6b5553f522cecdc7ec08
-
SHA1
4549b10402f20f6c27461436e9ecf6c532dced7f
-
SHA256
06c980f949509e4bcc09b65a9accfe872cd30af386799f0c74fd450f6f440240
-
SHA512
fbce2577f146268954f0eb3bcd263f5f0a6304e9d4343545d07c0a39a4e429df952e452eb3dacb32deda17df74b103237a366eb4c9fc76e7309fee00f1eba63e
-
SSDEEP
98304:yQvGLN+FnMx2FX1Wsnc6WudcSItiZrfHqWqXwU/P:yQvAsnLDnB1PIIZrPOXwU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource a9dd5607f44c6b5553f522cecdc7ec08_JaffaCakes118
Files
-
a9dd5607f44c6b5553f522cecdc7ec08_JaffaCakes118.exe windows:5 windows x86 arch:x86
b430ad14e57f162ecfdcfc41c9ab7cda
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetVolumeLabelA
TlsGetValue
SetLocalTime
_llseek
GetNumberOfConsoleInputEvents
FindResourceExW
DeleteVolumeMountPointA
ReadConsoleA
CompareFileTime
WaitForSingleObject
OpenSemaphoreA
CallNamedPipeW
SetTapeParameters
GetProcessPriorityBoost
GetTickCount
LocalFlags
WriteFile
GetCommandLineA
SetCommTimeouts
InitializeCriticalSection
_hread
GetVersionExW
WritePrivateProfileStructW
WriteConsoleW
GetTimeZoneInformation
lstrcatA
GetBinaryTypeW
GetOverlappedResult
lstrlenW
EnumResourceNamesW
DisconnectNamedPipe
DeactivateActCtx
CreateJobObjectA
InterlockedExchange
GlobalUnfix
IsDBCSLeadByteEx
GetProcAddress
BeginUpdateResourceW
CreateNamedPipeA
ReadFileEx
LoadLibraryA
OpenMutexA
LocalAlloc
SetConsoleDisplayMode
AddAtomW
SetCurrentDirectoryW
SetFileApisToANSI
WriteProfileSectionW
GetPrivateProfileStructA
GetTapeParameters
WaitForMultipleObjects
EnumDateFormatsA
GetThreadPriority
LoadLibraryExA
GetConsoleCursorInfo
ScrollConsoleScreenBufferA
SetCalendarInfoA
lstrcpyA
FillConsoleOutputCharacterA
GlobalUnlock
GetSystemDefaultLangID
InterlockedIncrement
InterlockedDecrement
Sleep
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetLastError
HeapFree
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStartupInfoA
RtlUnwind
RaiseException
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
GetCPInfo
GetCurrentProcessId
GetModuleHandleW
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
CloseHandle
GetFileType
CreateFileA
HeapAlloc
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
ExitProcess
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
QueryPerformanceCounter
GetSystemTimeAsFileTime
HeapSize
GetACP
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
InitializeCriticalSectionAndSpinCount
SetStdHandle
GetConsoleCP
GetConsoleMode
SetFilePointer
SetEndOfFile
GetProcessHeap
ReadFile
GetLocaleInfoW
FlushFileBuffers
WriteConsoleA
GetConsoleOutputCP
GetModuleHandleA
gdi32
GetBoundsRect
GetBitmapDimensionEx
Sections
.text Size: 3.8MB - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 91.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ