Static task
static1
Behavioral task
behavioral1
Sample
03a75c4891a27d6d037f8c58663a87f8_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
03a75c4891a27d6d037f8c58663a87f8_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
03a75c4891a27d6d037f8c58663a87f8_JaffaCakes118
-
Size
128KB
-
MD5
03a75c4891a27d6d037f8c58663a87f8
-
SHA1
3261412d39b7b247ce445c8c91380f828d7d7c69
-
SHA256
f64fed8abd8e071721be1b5fdd404bddd5ec2539ba063a55119db84b1f388620
-
SHA512
41124ccc02e94c497cccbbdd6eb936f3e68ef12b0705bf05ac4498299d7c95aabfc5a67afbc51bdc84a43e98dd94c7518c6f02c99267a01a870a4ac8c4cc808d
-
SSDEEP
1536:Tg71uT6OsjOOQqKyG/cyqqtkQ9jHRgVKlmox8G8x/8DY0t/D0TLanXca:T3jsjOdPHHjHRgVDox8G8x/8DNt/Dlnj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 03a75c4891a27d6d037f8c58663a87f8_JaffaCakes118
Files
-
03a75c4891a27d6d037f8c58663a87f8_JaffaCakes118.exe windows:4 windows x86 arch:x86
64b2c8ad8081ae348706d351f68d2619
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
version
GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA
wininet
InternetOpenA
InternetCloseHandle
InternetOpenUrlA
InternetReadFile
kernel32
CloseHandle
GetProcAddress
FreeLibrary
CreateDirectoryA
GetLastError
LoadLibraryA
EnterCriticalSection
LeaveCriticalSection
SetEvent
MapViewOfFile
InitializeCriticalSection
UnmapViewOfFile
CreateThread
lstrcpynA
DeleteCriticalSection
TerminateThread
WaitForMultipleObjects
CreateFileMappingA
CreateEventA
WaitForSingleObject
ResetEvent
lstrcmpA
GetFileAttributesA
ReadFile
DisconnectNamedPipe
FlushFileBuffers
WriteFile
ConnectNamedPipe
CallNamedPipeA
CreateNamedPipeA
OutputDebugStringA
GetModuleFileNameA
lstrlenA
Sleep
MoveFileExA
GetPrivateProfileSectionA
WritePrivateProfileSectionA
GetWindowsDirectoryA
GetShortPathNameA
GetVersionExA
SetEndOfFile
SetFilePointer
GetCurrentProcess
GetFileType
SetStdHandle
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
MultiByteToWideChar
LCMapStringA
lstrcmpiA
lstrcatA
CreateFileA
lstrcpyA
CreateProcessA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateMutexA
HeapSize
GetConsoleMode
GetConsoleCP
GetCurrentProcessId
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
HeapFree
HeapAlloc
GetCommandLineA
GetProcessHeap
GetStartupInfoA
RaiseException
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
RtlUnwind
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
ExitProcess
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
QueryPerformanceCounter
GetTickCount
user32
LoadStringA
TranslateMessage
DefWindowProcA
PostQuitMessage
DestroyWindow
CreateWindowExA
RegisterClassExA
LoadCursorA
LoadIconA
DispatchMessageA
GetMessageA
wsprintfA
advapi32
RegDeleteValueA
RegOpenKeyExA
GetTokenInformation
DuplicateTokenEx
CreateProcessAsUserA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
RegCloseKey
RegQueryValueExA
RegSetValueExA
RegCreateKeyExA
shell32
ShellExecuteExA
Sections
.text Size: 68KB - Virtual size: 65KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ