Static task
static1
Behavioral task
behavioral1
Sample
b1d7dc437446c82feeee6b4627de83c5_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
b1d7dc437446c82feeee6b4627de83c5_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
b1d7dc437446c82feeee6b4627de83c5_JaffaCakes118
-
Size
3.1MB
-
MD5
b1d7dc437446c82feeee6b4627de83c5
-
SHA1
a03959bb4fbd2c7adb234bebf0ec9d5e385a9b93
-
SHA256
3c90c1fdcfd82cee12f2360eee874e4dc0a2a87b0163ee6ceaaaa41f877bdbe3
-
SHA512
0e1b83d6b8577d000b12298766ca07ac65b900d54e53d75c93f6299c21a081a205526fabff76b68092767a2def2c3b2b9d3d3ce696995fb424c48516f937cb51
-
SSDEEP
49152:yO2IBeHNBqw2Lq1XfvOyatIEKGnOzh/yBDkYfMUgv64SV:VBeH2w2LuXn7A6wRfMUgzS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b1d7dc437446c82feeee6b4627de83c5_JaffaCakes118
Files
-
b1d7dc437446c82feeee6b4627de83c5_JaffaCakes118.exe windows:6 windows x64 arch:x64
291991da8bbbc1b37483031156a68b46
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
Process32Next
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
EmptyClipboard
CharUpperBuffW
advapi32
ConvertStringSecurityDescriptorToSecurityDescriptorA
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
msvcp140
_Cnd_wait
winhttp
WinHttpConnect
vcruntime140
strchr
api-ms-win-crt-runtime-l1-1-0
_register_onexit_function
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-stdio-l1-1-0
fread
api-ms-win-crt-filesystem-l1-1-0
_stat64i32
api-ms-win-crt-string-l1-1-0
isspace
api-ms-win-crt-environment-l1-1-0
getenv_s
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wsock32
setsockopt
ws2_32
getaddrinfo
api-ms-win-crt-convert-l1-1-0
strtoul
wtsapi32
WTSSendMessageW
Sections
.text Size: - Virtual size: 793KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 125KB - Virtual size: 125KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_TEXT_CN Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 2.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 2.9MB - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 63KB - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ