Static task
static1
Behavioral task
behavioral1
Sample
b4d40711506af22a5d915260470375a4_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
b4d40711506af22a5d915260470375a4_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
b4d40711506af22a5d915260470375a4_JaffaCakes118
-
Size
2.1MB
-
MD5
b4d40711506af22a5d915260470375a4
-
SHA1
a32f19da8238c07ce113ba4f04ebdae2a94b6960
-
SHA256
25e0a857dcb058bb4183f83782e91bf7b6ab630b2a3d9a91f2daeb79415b52eb
-
SHA512
9430ba421d15abacc5937b05d2cafcf6675203be439a5cda0f95770269292c0c5bb601c3b66a2bcc6b638e13bb7629ae26d5c4419bf54a128b01539525eb98e6
-
SSDEEP
49152:O3LRjFtAmaBWa90OnxZL81emFErHyPttfJffTk9xM9k9YOADpGS29YXttZGrYM:cLR5tAmaBWaWOnxZY/FQS/JffTk9xM9X
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b4d40711506af22a5d915260470375a4_JaffaCakes118
Files
-
b4d40711506af22a5d915260470375a4_JaffaCakes118.exe windows:5 windows x86 arch:x86
8a0376500cdb2c7e730997d64c41b245
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WaitForSingleObject
CloseHandle
OpenMutexA
GetModuleHandleW
CreateProcessW
GetTempPathW
CreateDirectoryW
DeleteFileW
GetVersionExW
MultiByteToWideChar
WideCharToMultiByte
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
WriteFile
CreateFileW
InterlockedDecrement
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
EncodePointer
IsDebuggerPresent
OutputDebugStringW
lstrlenA
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
RtlUnwind
GetCPInfo
HeapReAlloc
UnhandledExceptionFilter
SetLastError
GetCurrentProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
IsProcessorFeaturePresent
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetModuleHandleExW
HeapSize
GetCurrentThreadId
GetProcessHeap
GetStdHandle
GetModuleFileNameW
IsValidCodePage
GetACP
GetOEMCP
GetTimeZoneInformation
GetFileType
QueryPerformanceCounter
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
ReadFile
SetFilePointerEx
LoadLibraryExW
ReadConsoleW
SetStdHandle
WriteConsoleW
SetEndOfFile
SetEnvironmentVariableA
TerminateProcess
GetProcAddress
CopyFileW
GetFileAttributesW
GetCommandLineW
Sleep
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
RaiseException
ExitProcess
LocalFree
SetUnhandledExceptionFilter
DecodePointer
advapi32
OpenSCManagerW
CreateServiceW
CloseServiceHandle
ChangeServiceConfig2W
RegEnumKeyExW
RegCreateKeyExW
CryptEncrypt
StartServiceW
RegCloseKey
RegOpenKeyW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
CryptImportKey
CryptSetKeyParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
ole32
CoInitializeSecurity
CoSetProxyBlanket
CoUninitialize
CoInitializeEx
CoCreateInstance
oleaut32
SysFreeString
SysStringLen
VariantClear
VariantInit
SysAllocString
Sections
.text Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 75KB - Virtual size: 74KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.dwok Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 64KB - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ