Static task
static1
Behavioral task
behavioral1
Sample
0612a2d6657a89fc2235584c15376ccf_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
0612a2d6657a89fc2235584c15376ccf_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
0612a2d6657a89fc2235584c15376ccf_JaffaCakes118
-
Size
67KB
-
MD5
0612a2d6657a89fc2235584c15376ccf
-
SHA1
c0c9ab482ecef05fd1bf8261e44c540d1e15d1f7
-
SHA256
cb54a5c927a3f732b659068b1ad1439e983cdd005108ccb65985ce2ff6d59453
-
SHA512
6902a5297748f54b67e181d3cd42692c966352f2ffeb2cd6997bf99f76d598a8d313be63805292dfbc0c200bf99ae6945dd4dd1b15ffbdff0b35df6ac5e0de70
-
SSDEEP
1536:nNiKxmEU02xyx6pnnmqXMG+Gm+PEVfUnThMsMT9ssr/kH:N1xO02wengywVEC93r/kH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0612a2d6657a89fc2235584c15376ccf_JaffaCakes118
Files
-
0612a2d6657a89fc2235584c15376ccf_JaffaCakes118.exe windows:4 windows x86 arch:x86
a267248d67f05f3fad749b830e3bc464
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
CreateServiceA
DeleteService
EqualSid
GetSecurityDescriptorControl
GetUserNameA
QueryServiceStatus
RegDeleteKeyA
RegDeleteValueA
kernel32
CloseHandle
ContinueDebugEvent
CopyFileA
CreateDirectoryA
CreateEventA
CreateFileA
CreateFileMappingA
DeleteCriticalSection
DeleteFileA
DisableThreadLibraryCalls
EnterCriticalSection
ExitProcess
FindNextFileA
FreeEnvironmentStringsA
FreeLibrary
GetCurrentProcess
GetCurrentThreadId
GetDriveTypeA
GetEnvironmentStringsA
GetExitCodeProcess
GetFileType
GetFullPathNameA
GetLastError
GetModuleHandleA
GetPrivateProfileSectionA
GetPrivateProfileStringA
GetProcAddress
GetStartupInfoA
GetStdHandle
GetStringTypeA
GetSystemTime
GetSystemTimeAsFileTime
GetTempPathA
GetThreadTimes
GetTickCount
GetTimeZoneInformation
GetUserDefaultLCID
GetVersionExA
GlobalAlloc
GlobalHandle
GlobalUnlock
HeapAlloc
HeapDestroy
HeapFree
HeapReAlloc
InitializeCriticalSection
InterlockedExchange
InterlockedIncrement
IsBadCodePtr
IsBadWritePtr
IsDebuggerPresent
IsValidCodePage
LeaveCriticalSection
LoadLibraryA
LoadResource
MapViewOfFile
Module32First
MoveFileExA
RaiseException
ResumeThread
RtlUnwind
SearchPathA
SetEvent
SetFileAttributesA
SetHandleCount
SetThreadPriority
Sleep
TerminateProcess
VirtualAlloc
VirtualProtect
VirtualQuery
WideCharToMultiByte
WriteFile
lstrcatA
lstrcmpA
lstrcmpiA
lstrcpynA
lstrlenA
user32
CharPrevA
CreateDialogParamA
CreatePopupMenu
CreateWindowExA
EndPaint
FillRect
FindWindowA
GetCursorPos
GetDC
GetDlgItem
GetDlgItemTextA
GetMessageA
GetParent
GetSubMenu
GetSysColor
GetSysColorBrush
GetSystemMetrics
GetWindowLongA
LoadBitmapA
LoadCursorA
LoadIconA
MessageBoxA
MsgWaitForMultipleObjects
OffsetRect
PostQuitMessage
RegisterClassA
RegisterClassExA
SendMessageA
SetWindowRgn
SystemParametersInfoA
UpdateWindow
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
Sections
.text Size: 30KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.bss Size: 14KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 15KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
ounqr Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
tieoq Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ