Static task
static1
Behavioral task
behavioral1
Sample
0379a18bde3999dd00da3d7435a72ac7_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0379a18bde3999dd00da3d7435a72ac7_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
0379a18bde3999dd00da3d7435a72ac7_JaffaCakes118
-
Size
157KB
-
MD5
0379a18bde3999dd00da3d7435a72ac7
-
SHA1
8d2ff41aa9dd977e4a8c4aff82bbb772923b91f6
-
SHA256
bbca1f6d7a832e8a99df8fd9194d498aeb86f0f5540c63271dd6c30642bf67af
-
SHA512
8d3cf1d4f81644240ab82228f35b8cd8ca62713f59c9cc1e977a5a383582ef76e9af57649778b9fe60d1c5813faff8bf483f04f6a9024a34f70acf5e65d6679e
-
SSDEEP
3072:ZYaF67WxsjyFkWQZf2HPiz4ccZW3Ly632/0NR7qkCAiXO5XanDeQkwQcj:+agysGFkWMz4ccZE263Q0r7Ru2XanDeE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0379a18bde3999dd00da3d7435a72ac7_JaffaCakes118
Files
-
0379a18bde3999dd00da3d7435a72ac7_JaffaCakes118.exe windows:5 windows x86 arch:x86
8de7742be75fecabc7340a642d122696
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CompareStringW
GetACP
GetOEMCP
CreateMutexA
CreateEventA
GetVersionExA
CreateSemaphoreA
GetModuleHandleW
CompareStringA
GetLocaleInfoW
GetModuleHandleA
GetStartupInfoW
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameW
FreeEnvironmentStringsA
MultiByteToWideChar
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetEnvironmentStrings
GetCommandLineW
GetCommandLineA
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
GetCurrentThread
GetModuleFileNameA
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
WriteFile
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
FatalAppExitA
HeapAlloc
VirtualAlloc
HeapReAlloc
IsBadWritePtr
GetProcAddress
LoadLibraryA
InterlockedDecrement
InterlockedIncrement
Sleep
WideCharToMultiByte
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetCPInfo
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
GetTimeZoneInformation
SetEnvironmentVariableA
user32
SetWindowTextA
LoadCursorA
gdi32
AbortDoc
GetTextColor
GetRasterizerCaps
SetTextColor
SetTextAlign
GetTextAlign
crypt32
CertStrToNameA
rtm
RtmBlockMethods
Sections
.text Size: 38KB - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 110KB - Virtual size: 191KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 568B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ