Static task
static1
Behavioral task
behavioral1
Sample
05cdca53517fb3b0aa0f4337e20a6e3e_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
05cdca53517fb3b0aa0f4337e20a6e3e_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
05cdca53517fb3b0aa0f4337e20a6e3e_JaffaCakes118
-
Size
254KB
-
MD5
05cdca53517fb3b0aa0f4337e20a6e3e
-
SHA1
9e3cf1adcea8642dd0fada581c24074b55b14bce
-
SHA256
9b5903113b1f60e31bdd1f3fa1ea1b57004a0cb4c16676744f84f981cbc555ac
-
SHA512
09e002b2059e1df8d5683b5e02396b656ce5866369ef161459884b48ad58e12a0dcbdfb7dc3323d4832c8397be04d830e208b7d2a9bab69f21ccad36e97c15e5
-
SSDEEP
6144:3lHRK6RZ/LuFzEDTMZZfIZXNjNsRJNaNWx0IKaZhWZKln10j:3lHg63/LuAMQjsNaIxNTZhCA10j
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 05cdca53517fb3b0aa0f4337e20a6e3e_JaffaCakes118
Files
-
05cdca53517fb3b0aa0f4337e20a6e3e_JaffaCakes118.exe windows:4 windows x86 arch:x86
50f763d828d1e1a7b372651b0f5de0b9
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
netapi32
NetApiBufferFree
NetUserEnum
kernel32
lstrcmpW
CompareFileTime
lstrlenA
lstrlenW
lstrcpynW
FreeLibrary
CreateDirectoryW
LocalAlloc
RemoveDirectoryW
GetWindowsDirectoryW
LocalFree
IsDebuggerPresent
GetCurrentThreadId
WaitForSingleObject
CreateEventW
ExpandEnvironmentStringsA
OpenEventW
GetModuleHandleW
GetTempPathW
SetUnhandledExceptionFilter
GetVersion
GetProcAddress
user32
GetForegroundWindow
GetSystemMetrics
CopyRect
RegisterWindowMessageW
GetCursorPos
InvalidateRect
GetFocus
LoadCursorW
DestroyIcon
GetSysColor
MoveWindow
IsWindow
GetTopWindow
SetTimer
OffsetRect
PostMessageW
SetWindowPos
SendMessageW
EnableWindow
gdi32
CreateFontIndirectW
CreateRectRgn
CreateCompatibleDC
DeleteObject
CreatePatternBrush
CreateSolidBrush
advapi32
IsValidSecurityDescriptor
FreeSid
RegOpenKeyExA
RegQueryValueExA
OpenServiceW
StartServiceW
QueryServiceStatus
OpenSCManagerW
CloseServiceHandle
RegCreateKeyExW
RegDeleteValueW
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RevertToSelf
AddAccessAllowedAce
SetSecurityDescriptorOwner
AllocateAndInitializeSid
InitializeAcl
ImpersonateSelf
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AccessCheck
SetSecurityDescriptorGroup
OpenThreadToken
OpenProcessToken
GetLengthSid
shell32
ShellExecuteW
usp10
UspFreeMem
ScriptApplyDigitSubstitution
ScriptCPtoX
ScriptJustify
icmp
IcmpCloseHandle
IcmpParseReplies
Sections
.text Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.IjU Size: 2KB - Virtual size: 207KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.kXA Size: 2KB - Virtual size: 395KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ze Size: 2KB - Virtual size: 543KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 2KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UsAk Size: 2KB - Virtual size: 310KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.CW Size: 93KB - Virtual size: 138KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.XLbC Size: 2KB - Virtual size: 74KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 7KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.w Size: 122KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ