Static task
static1
Behavioral task
behavioral1
Sample
07deec5a3cdfd37badcac3223eaf8297_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
07deec5a3cdfd37badcac3223eaf8297_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
07deec5a3cdfd37badcac3223eaf8297_JaffaCakes118
-
Size
528KB
-
MD5
07deec5a3cdfd37badcac3223eaf8297
-
SHA1
4aac8c9f06e73882fbd1db29e06ea90fa6864244
-
SHA256
595151645a8d7b0c5ac3032a001f64dc6341bdc9225ee320cd520579dca5cc3d
-
SHA512
4b2748e96738d02ec9261d63c6245dbdc61fa64658a68b8d6b872769d5d26a611bda142a6527ffa3f6895e1a2abaaa31b19e02b9aebaa01fce1ecf0e50f2a4ad
-
SSDEEP
12288:hc3FHVDxZP6EyL0B7+zb9Xxh6Fo5SHgb/yn7IBqvEiNoR7i:hc3dVDxkEyLC+/9Bh6uIC/y7REi+7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 07deec5a3cdfd37badcac3223eaf8297_JaffaCakes118
Files
-
07deec5a3cdfd37badcac3223eaf8297_JaffaCakes118.exe windows:4 windows x86 arch:x86
198142ab9577fab1f8281bf6855ef376
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FlushViewOfFile
SetFilePointer
GetShortPathNameA
MoveFileExA
CopyFileA
WinExec
WaitForSingleObject
CreateProcessA
FlushFileBuffers
CreateEventA
OpenMutexA
GetVolumeInformationA
GetSystemDirectoryA
GetWindowsDirectoryA
FreeLibrary
GetProcAddress
LoadLibraryA
SetSystemTime
GetSystemTime
MultiByteToWideChar
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetCommandLineA
GetDiskFreeSpaceExA
GetBinaryTypeA
LockResource
LoadResource
SizeofResource
FindResourceA
GetVersionExA
CreateFileA
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
InterlockedIncrement
OpenProcess
GetModuleHandleA
lstrlenA
GetModuleFileNameA
lstrlenW
WideCharToMultiByte
LoadLibraryExA
lstrcmpiA
lstrcpynA
IsDBCSLeadByte
GetSystemTimeAsFileTime
GetCurrentDirectoryA
ReadFile
DeviceIoControl
GetFullPathNameA
FileTimeToLocalFileTime
FileTimeToSystemTime
CreateToolhelp32Snapshot
Process32First
LocalFree
WriteFile
GetLogicalDrives
CloseHandle
Process32Next
RaiseException
DeleteCriticalSection
InitializeCriticalSection
GetDriveTypeA
SetEndOfFile
FindFirstFileA
SetFileAttributesA
DeleteFileA
FindNextFileA
GetLastError
CreateDirectoryA
FindClose
GetEnvironmentVariableA
CreateFileMappingA
GetTempPathA
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetTimeZoneInformation
SearchPathA
InterlockedDecrement
GetFileAttributesA
ExitProcess
RtlUnwind
HeapFree
MoveFileA
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapAlloc
HeapReAlloc
GetStartupInfoA
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
HeapSize
HeapDestroy
HeapCreate
VirtualFree
IsBadWritePtr
LCMapStringA
LCMapStringW
GetOEMCP
GetCPInfo
SetUnhandledExceptionFilter
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStringTypeA
GetStringTypeW
IsBadReadPtr
IsBadCodePtr
SetStdHandle
user32
CharNextA
DefWindowProcA
DestroyWindow
gdi32
SelectObject
GetTextExtentPoint32A
GetTextCharsetInfo
advapi32
RegEnumKeyExA
RegNotifyChangeKeyValue
RegQueryInfoKeyA
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
GetUserNameA
CreateProcessAsUserA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegSetKeySecurity
OpenProcessToken
ole32
CoTaskMemRealloc
CoUninitialize
CoInitialize
CoCreateInstance
CoTaskMemAlloc
CoTaskMemFree
oleaut32
VarUI4FromStr
SysAllocString
VariantClear
comctl32
InitCommonControlsEx
shell32
SHGetFolderPathA
Sections
.text Size: 172KB - Virtual size: 169KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 324KB - Virtual size: 323KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ