Static task
static1
Behavioral task
behavioral1
Sample
00d056183ad492fe99e5aaa13df8fd29_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
00d056183ad492fe99e5aaa13df8fd29_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
00d056183ad492fe99e5aaa13df8fd29_JaffaCakes118
-
Size
277KB
-
MD5
00d056183ad492fe99e5aaa13df8fd29
-
SHA1
6b58d592b224e010fca036ccb9a3c317dfe72ee2
-
SHA256
c3223e46c1d2f87fb54e0f82d3a9d2d9f085e13c45b20c0064f14f4d9302c125
-
SHA512
75b83b8acda9dc6fd96976ed1e20082958408f422e719296305f99e021dd59b291f4883f6f3dd65d4fbe6003d584ff6a36b32656a59e990852ab25ac17c173e1
-
SSDEEP
6144:rV1VjlMindSC/xSAZ21ICSFjmf9fWDCxS2K0naW+tIqlnlkka:r1jlMiSGxBUVSFmf9fx2G4eu6r
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 00d056183ad492fe99e5aaa13df8fd29_JaffaCakes118
Files
-
00d056183ad492fe99e5aaa13df8fd29_JaffaCakes118.exe windows:4 windows x86 arch:x86
330f2c5dace9c3041f0ad21343d6373a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetWindowsDirectoryA
lstrcpyA
ExpandEnvironmentStringsA
lstrcpyW
ExpandEnvironmentStringsW
GetCurrentThreadId
GetSystemInfo
GetModuleHandleW
GetTempPathA
GetTempFileNameA
SetErrorMode
OpenEventA
OpenMutexA
OpenSemaphoreA
CreateEventA
GetSystemDirectoryA
CreateSemaphoreA
SleepEx
QueryPerformanceFrequency
SetUnhandledExceptionFilter
CreateSemaphoreW
WaitForSingleObject
GetModuleHandleA
FreeLibrary
GetProcessHeap
CreateMutexA
IsDebuggerPresent
GetStartupInfoW
GetProcAddress
user32
GetSystemMetrics
wsprintfA
CharUpperA
CharLowerA
CharUpperW
CharLowerW
advapi32
DuplicateTokenEx
GetUserNameA
LookupAccountSidA
LookupPrivilegeValueA
AdjustTokenPrivileges
GetTokenInformation
EqualSid
InitializeAcl
AddAccessAllowedAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetSecurityDescriptorSacl
AllocateAndInitializeSid
GetLengthSid
FreeSid
CopySid
OpenThreadToken
ImpersonateLoggedOnUser
OpenProcessToken
DuplicateToken
SetThreadToken
RevertToSelf
shlwapi
PathUnExpandEnvStringsW
PathUnExpandEnvStringsA
rtutils
RouterLogRegisterW
RouterLogEventW
RouterLogDeregisterW
TraceVprintfExW
LogEventW
iyuv_32
DllMain
AboutDialogProc
Sections
.text Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.ui Size: 4KB - Virtual size: 539KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.TRYlp Size: 99KB - Virtual size: 120KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.DZ Size: 1KB - Virtual size: 97KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 2KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.qsdP Size: 1024B - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 7KB - Virtual size: 178KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.GRSLe Size: 115KB - Virtual size: 136KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.FmqEgM Size: 3KB - Virtual size: 184KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ