Static task
static1
Behavioral task
behavioral1
Sample
00f067a17fd1ea52a5a7ac279e78bb0f_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
00f067a17fd1ea52a5a7ac279e78bb0f_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
00f067a17fd1ea52a5a7ac279e78bb0f_JaffaCakes118
-
Size
92KB
-
MD5
00f067a17fd1ea52a5a7ac279e78bb0f
-
SHA1
ec60ae9dcc05e5691d93f25ec7225061095f4404
-
SHA256
d1831a550f53b1912da36879fede57e6209cc0c99f611c8de1405b7de3d5473d
-
SHA512
ac27dd8c440128f092045a6a1eada01fb8b9323e87f9db2e333185e548b3cfe16f8ef078090d4adb39cb31c3c00ba18bf79e5c24399f653745404797c3813f86
-
SSDEEP
1536:WoW+/rHSnFNrqXet71pevGtOzwRmAjlUK29TZCo2H:k+DHc8lHemmll2FZCoq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 00f067a17fd1ea52a5a7ac279e78bb0f_JaffaCakes118
Files
-
00f067a17fd1ea52a5a7ac279e78bb0f_JaffaCakes118.exe windows:4 windows x86 arch:x86
28e77c947e903ee1c8f5339e76c477e0
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
InterlockedExchange
GetACP
GetLocaleInfoA
GetVersionExA
RaiseException
InitializeCriticalSection
DeleteCriticalSection
WriteFile
GetProcAddress
LoadLibraryA
lstrcpynA
GetComputerNameA
GetLastError
GetModuleFileNameA
lstrcpyA
CreateDirectoryA
GetTempFileNameA
GetTempPathA
SizeofResource
LockResource
LoadResource
FindResourceA
lstrlenA
SetFilePointer
CreateFileA
CloseHandle
MultiByteToWideChar
InterlockedDecrement
GetEnvironmentStrings
FreeEnvironmentStringsA
LocalFree
GetSystemInfo
VirtualProtect
GetCPInfo
GetOEMCP
GetStringTypeW
GetStringTypeA
IsBadCodePtr
IsBadReadPtr
GetFileType
SetHandleCount
GetEnvironmentStringsW
UnhandledExceptionFilter
GetStdHandle
LCMapStringW
WideCharToMultiByte
LCMapStringA
HeapSize
ExitProcess
RtlUnwind
HeapFree
GetSystemTimeAsFileTime
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
HeapReAlloc
HeapAlloc
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
VirtualQuery
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
SetUnhandledExceptionFilter
TerminateProcess
GetCurrentProcess
FreeEnvironmentStringsW
shell32
SHGetSpecialFolderPathA
shlwapi
PathAppendA
StrStrA
rpcrt4
UuidCreate
UuidCreateSequential
ole32
CoCreateInstance
CoSetProxyBlanket
CoInitializeEx
CoUninitialize
CoInitializeSecurity
oleaut32
VariantClear
VariantChangeType
VariantInit
SysFreeString
SysAllocString
Sections
.text Size: 60KB - Virtual size: 57KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 259KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ