Static task
static1
Behavioral task
behavioral1
Sample
079d67cef4cb8a5f72ae8bf7842259da_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
079d67cef4cb8a5f72ae8bf7842259da_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
079d67cef4cb8a5f72ae8bf7842259da_JaffaCakes118
-
Size
306KB
-
MD5
079d67cef4cb8a5f72ae8bf7842259da
-
SHA1
f6b5e6f9349513a1515af3eeff9ae4184d7336f0
-
SHA256
1ca45299463eddd4ba004c2139deba5e0b8d1cdf90339990fef7e60fdf238f06
-
SHA512
2625321111ff3819e8e5a10f98d9e35eb8dfb064ef2d1c76a3b372d545bbf88ec3e51c9fd7ed1c3761b8db570ee6384b2b08aa66760d38e0d4aec2b234d98f32
-
SSDEEP
6144:zkOMD9hpIR8QuCKNNo7TgYY0m5tUrBvj5LwMQow7E:AOMh0UNP+NMl
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 079d67cef4cb8a5f72ae8bf7842259da_JaffaCakes118
Files
-
079d67cef4cb8a5f72ae8bf7842259da_JaffaCakes118.exe windows:4 windows x86 arch:x86
f5f509f045f134a036f425d81c439f50
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
EnumPropsExA
GetClassInfoExA
CallNextHookEx
AppendMenuW
MsgWaitForMultipleObjectsEx
GetScrollRange
MapVirtualKeyExW
GetCursorPos
GetSystemMenu
GetDC
GetWindowLongW
OemKeyScan
DialogBoxIndirectParamA
GetMenuState
GetClassInfoW
GetSystemMetrics
CreateCursor
mfcsubs
?RemoveAll@CMapStringToPtr@@QAEXXZ
?SetAtGrow@CStringArray@@QAEXHPBG@Z
??1CString@@QAE@XZ
??1CMapStringToPtr@@UAE@XZ
??YCString@@QAEABV0@PBG@Z
?Lookup@CMapStringToPtr@@QBEHPBGAAPAX@Z
?ReverseFind@CString@@QBEHG@Z
??H@YG?AVCString@@ABV0@0@Z
??0CStringArray@@QAE@XZ
?GetBuffer@CString@@QAEPAGH@Z
?Right@CString@@QBE?AV1@H@Z
?Mid@CString@@QBE?AV1@H@Z
??1CStringArray@@UAE@XZ
??H@YG?AVCString@@ABV0@PBG@Z
??0CString@@QAE@XZ
msvcrt
exit
_ultoa
rewind
vfprintf
_wstrdate
__p__osver
_spawnvp
__p__iob
rand
_access
winsta
WinStationCloseServer
WinStationGetAllProcesses
WinStationFreeGAPMemory
WinStationTerminateProcess
WinStationQueryInformationW
WinStationFreeMemory
WinStationDisconnect
WinStationEnumerateA
WinStationSendMessageW
WinStationGetTermSrvCountersValue
WinStationWaitSystemEvent
WinStationReset
WinStationOpenServerW
WinStationEnumerateProcesses
WinStationEnumerateW
kernel32
GetCommandLineW
GetStringTypeExA
ExitProcess
WritePrivateProfileStructW
GetCurrentProcessId
GetLogicalDrives
GetEnvironmentStringsA
RtlZeroMemory
GetACP
GetTickCount
GetUserDefaultLCID
Sleep
TlsAlloc
GetLastError
GetModuleHandleW
PeekConsoleInputW
CancelWaitableTimer
GetCurrentThread
DeleteCriticalSection
GetModuleHandleA
GetVersion
GetCurrentProcess
DeleteTimerQueueEx
GetCommandLineA
_lcreat
GetShortPathNameW
GetProcessHeap
OpenFile
GetCurrentThreadId
VirtualAlloc
PeekNamedPipe
GetEnvironmentVariableA
EnumResourceTypesA
scecli
SceCommitTransaction
SceSvcConvertTextToSD
SceCreateDirectory
SceGetSecurityProfileInfo
SceEnumerateServices
SceSvcSetInformationTemplate
SceUpdateObjectInfo
SceSvcQueryInfo
SceLookupPrivRightName
SceGetScpProfileDescription
Sections
.text Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.CRT Size: 512B - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 106KB - Virtual size: 206KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DATA Size: 170KB - Virtual size: 270KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ