Static task
static1
Behavioral task
behavioral1
Sample
066501ea34d7342eb69146190b4222b7_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
066501ea34d7342eb69146190b4222b7_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
066501ea34d7342eb69146190b4222b7_JaffaCakes118
-
Size
530KB
-
MD5
066501ea34d7342eb69146190b4222b7
-
SHA1
bc76beb5aaf1b4078e7fbf1b137e3467c5164046
-
SHA256
ad62d8b254ae52581b33dfc39f0908fb3be696e7a5167357adea60a20b96bf58
-
SHA512
9a40ba25ab7fc1b6292f17218748d7f32a8b51c7ec772a91deaed3cfbbfc9355160e1e3c0a3728fd0b2c9b8544d685a2f9ce75e467345df6d48b65d5c01803b1
-
SSDEEP
12288:GUjcFppkoXP7+Z/nju49JhF8FR9Ybii7/jEcGV4FEvA2Z0McBtAKXq:vYFppPj+NjuYJhF8FR0NjEcUHv/BAAKa
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 066501ea34d7342eb69146190b4222b7_JaffaCakes118
Files
-
066501ea34d7342eb69146190b4222b7_JaffaCakes118.exe windows:4 windows x86 arch:x86
f2b8c4f82b7706fd33d13fb9aedbc2af
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
comctl32
InitCommonControlsEx
advapi32
AbortSystemShutdownW
RegEnumValueW
DuplicateToken
AbortSystemShutdownA
CreateServiceA
CryptHashData
RegSaveKeyA
CryptGetHashParam
CryptEncrypt
CryptSetProviderExW
kernel32
HeapCreate
FreeEnvironmentStringsA
CloseHandle
GetProfileStringA
GetStartupInfoA
GetProcAddress
GetStringTypeA
GetLocalTime
GetTimeZoneInformation
FlushFileBuffers
CreateEventA
QueryPerformanceCounter
TlsFree
EnterCriticalSection
LCMapStringA
GetFileType
GetCPInfo
SetEnvironmentVariableA
SetHandleCount
GetModuleFileNameA
LoadLibraryA
WriteFile
InitializeCriticalSection
GetWindowsDirectoryW
GetCommandLineW
TlsSetValue
IsBadWritePtr
InterlockedExchange
LeaveCriticalSection
VirtualQuery
GetCurrentThreadId
VirtualAlloc
GetSystemTimeAsFileTime
VirtualFree
TerminateProcess
CompareStringW
SetStdHandle
WideCharToMultiByte
UnhandledExceptionFilter
GetTickCount
RtlUnwind
GetEnvironmentStrings
MultiByteToWideChar
GetStringTypeW
CreateMutexA
GetCommandLineA
GetVersion
LCMapStringW
GetStdHandle
GetModuleFileNameW
GetEnvironmentStringsW
ReadFile
GetCurrentThread
HeapFree
HeapReAlloc
InterlockedIncrement
SetLastError
GetModuleHandleA
GetCurrentProcess
GetCurrentProcessId
SetConsoleCP
ExitProcess
GetSystemTime
SetFilePointer
GetStartupInfoW
HeapAlloc
GetLastError
DeleteCriticalSection
GetProcessHeaps
InterlockedDecrement
TlsGetValue
OpenMutexA
CompareStringA
FreeEnvironmentStringsW
HeapDestroy
TlsAlloc
user32
OpenWindowStationW
GetWindowThreadProcessId
RegisterClassExA
GetClipboardData
RegisterWindowMessageA
PostMessageA
OpenInputDesktop
GetTabbedTextExtentW
OemToCharBuffW
SendNotifyMessageA
GetKeyboardState
WINNLSGetEnableStatus
EnumDesktopsA
RegisterClassA
gdi32
SetDIBColorTable
GetClipRgn
GetMetaFileBitsEx
FlattenPath
GetCharacterPlacementA
GetRegionData
SaveDC
GetPolyFillMode
GetCharABCWidthsFloatW
SetWindowOrgEx
FillPath
FixBrushOrgEx
EndDoc
SetROP2
StretchBlt
RemoveFontResourceW
GetEnhMetaFileBits
Sections
.text Size: 202KB - Virtual size: 202KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 314KB - Virtual size: 314KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ