Static task
static1
Behavioral task
behavioral1
Sample
b74cf245e3b7ee3efc4e6c987acf092d_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
b74cf245e3b7ee3efc4e6c987acf092d_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
b74cf245e3b7ee3efc4e6c987acf092d_JaffaCakes118
-
Size
216KB
-
MD5
b74cf245e3b7ee3efc4e6c987acf092d
-
SHA1
ed02aef8f1f30f67a4e40acb60af0076061e362e
-
SHA256
4dfd38dbb39f3ed69c713f601bc52b663a5cd08d37a2ececcbf8d54d8d179f05
-
SHA512
27178f5a008669245cec97d7b901e580615b71d03ae64cf8b94eaaa9b9df95c646fea2b3a8770f358cd24ec1979ab66b58202f07bd0b2303f972a409a06ab40b
-
SSDEEP
1536:/sbV7O4JpivB5elpDx9oFq6CEgZLdkX24VEkDomTkb5Y:/kV7rpiTevnowE4g24Vl0Akb+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b74cf245e3b7ee3efc4e6c987acf092d_JaffaCakes118
Files
-
b74cf245e3b7ee3efc4e6c987acf092d_JaffaCakes118.exe windows:1 windows x86 arch:x86
183b1c2817a73668dbe22a973b72749a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WideCharToMultiByte
HeapReAlloc
FormatMessageW
lstrcpyW
HeapFree
ReadFile
GetCurrentProcessId
LeaveCriticalSection
GetCurrentProcessId
LoadLibraryA
GetProcessHeap
InitializeCriticalSection
GetProcessHeap
GetCurrentThreadId
GetCurrentProcess
WaitForSingleObject
SetFilePointer
VirtualFree
lstrlenW
MultiByteToWideChar
GetTickCount
GetStartupInfoW
LoadLibraryW
FormatMessageW
GetStartupInfoW
FormatMessageW
GetCurrentProcess
GetCurrentProcess
GetCurrentProcess
FreeLibrary
LeaveCriticalSection
LoadLibraryW
SetFilePointer
GetVersionExA
LoadLibraryW
LocalAlloc
FreeLibrary
GetModuleFileNameA
HeapAlloc
Sleep
GetACP
CreateFileW
GetModuleFileNameA
GetTickCount
WaitForSingleObject
InterlockedIncrement
GetCurrentThreadId
InterlockedDecrement
GetModuleHandleA
GetTickCount
InterlockedDecrement
lstrcmpiW
WaitForSingleObject
HeapDestroy
InitializeCriticalSection
LoadLibraryW
GetVersionExA
HeapAlloc
HeapDestroy
lstrlenW
lstrlenW
GetModuleHandleW
GetCurrentThreadId
GetVersionExA
DeleteCriticalSection
GetCommandLineW
VirtualFree
VirtualAlloc
lstrcmpiW
DeleteCriticalSection
ExitProcess
InterlockedIncrement
FormatMessageW
GetModuleHandleW
DeleteCriticalSection
GetStartupInfoW
CloseHandle
UnhandledExceptionFilter
GetCommandLineA
lstrcmpiW
HeapDestroy
UnhandledExceptionFilter
GetStartupInfoW
WaitForSingleObject
CreateThread
InterlockedDecrement
HeapDestroy
GetModuleFileNameA
InterlockedDecrement
WideCharToMultiByte
GetModuleFileNameA
LocalAlloc
GetACP
VirtualFree
GetCommandLineW
LoadLibraryW
GetProcAddress
GetCommandLineW
InterlockedDecrement
InitializeCriticalSection
GetCurrentThreadId
LocalAlloc
UnhandledExceptionFilter
CreateThread
GetTickCount
UnhandledExceptionFilter
lstrcmpiW
TerminateProcess
CloseHandle
lstrcmpiW
MultiByteToWideChar
CreateThread
lstrcmpiW
InterlockedDecrement
GetCurrentThreadId
CreateThread
lstrcmpiW
QueryPerformanceCounter
WaitForSingleObject
SetLastError
InterlockedDecrement
GetCurrentThreadId
lstrcmpiW
InterlockedDecrement
GetVersionExA
CloseHandle
GetModuleFileNameA
WriteFile
GetModuleHandleW
LoadLibraryW
QueryPerformanceCounter
CloseHandle
GetACP
GetCommandLineA
GetTickCount
InitializeCriticalSection
InterlockedDecrement
LoadLibraryW
GetCommandLineA
UnhandledExceptionFilter
ExitProcess
DeleteCriticalSection
HeapDestroy
CreateThread
HeapFree
SetEvent
GetCommandLineW
VirtualFree
HeapReAlloc
VirtualFree
GetStartupInfoW
GetLastError
lstrcmpiW
CreateThread
HeapFree
EnterCriticalSection
GetModuleFileNameA
FormatMessageW
VirtualAlloc
CreateFileW
FormatMessageW
GetCommandLineW
HeapDestroy
UnhandledExceptionFilter
GetVersionExA
lstrlenW
lstrcpyW
GetModuleHandleW
UnhandledExceptionFilter
GetStartupInfoW
GetModuleFileNameA
lstrcpyW
MultiByteToWideChar
GetCurrentProcessId
GetProcAddress
CloseHandle
GetCommandLineA
LocalFree
Sleep
ReadFile
HeapAlloc
GetModuleHandleA
HeapDestroy
GetModuleHandleA
GetCurrentProcessId
GetModuleHandleA
Sleep
GetModuleHandleA
SetLastError
VirtualFree
LocalFree
GetModuleHandleA
HeapReAlloc
LoadLibraryW
HeapFree
lstrcmpiW
SetEvent
HeapReAlloc
LeaveCriticalSection
CreateThread
VirtualAlloc
EnterCriticalSection
VirtualAlloc
GetModuleHandleA
GetACP
LocalFree
SetEvent
GetModuleHandleA
SetFilePointer
GetModuleFileNameA
Sections
�text Size: 191KB - Virtual size: 196KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
�idata Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
�idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
�idata Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
�vmp0 Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
�reloc Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
�reloc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
�reloc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
�reloc Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE