Static task
static1
Behavioral task
behavioral1
Sample
096315bd30e46837b8bbe0e8248cf144_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
096315bd30e46837b8bbe0e8248cf144_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
096315bd30e46837b8bbe0e8248cf144_JaffaCakes118
-
Size
224KB
-
MD5
096315bd30e46837b8bbe0e8248cf144
-
SHA1
202d7a3b9506ba533c8c1ec781a8570f8bd0aa2f
-
SHA256
7d59d19f21d4a189144f3ee7d68a1ec0bb65812e9b2c9ba94252d9c802301729
-
SHA512
e070ee5362fce33aa424147e90d29ece689630a65655ed4903f89b81c6f927a120db72ac04673263e4fbadb27ac8907d0cd77b0b59d7c1a09afa5d2430eb0c05
-
SSDEEP
1536:YeOi1mXkmwy56kttcXHnAzD7AE+vHriZt2rei5Levy2WCma+M:TVGkJ/HAtZtti5Levy8ma+M
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 096315bd30e46837b8bbe0e8248cf144_JaffaCakes118
Files
-
096315bd30e46837b8bbe0e8248cf144_JaffaCakes118.exe windows:5 windows x86 arch:x86
ff8a15cbe4b531ba9c73c9b03a5df1f2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
StrNCatA
SHDeleteKeyA
PathFileExistsA
StrStrIA
StrToIntA
wnsprintfA
kernel32
MoveFileExA
SetEndOfFile
GetCurrentProcess
Process32First
GetTickCount
WriteFile
CreateProcessA
ReadFile
lstrcatA
FindFirstFileA
lstrcmpiA
FindClose
GetPrivateProfileStringA
Process32Next
GetModuleFileNameA
FindNextFileA
CreateToolhelp32Snapshot
CloseHandle
GetTempPathA
CreateThread
GetSystemTimeAsFileTime
GetConsoleOutputCP
lstrlenA
SetStdHandle
InitializeCriticalSectionAndSpinCount
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
MultiByteToWideChar
LCMapStringA
RaiseException
GetConsoleMode
GetConsoleCP
RtlUnwind
HeapReAlloc
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
GetCurrentProcessId
QueryPerformanceCounter
SetFilePointer
lstrcmpA
GetFileSize
CreateFileA
GetVolumeInformationA
GetComputerNameA
GetModuleHandleA
DeleteFileA
RemoveDirectoryA
GetLastError
GetFileAttributesA
Sleep
GetProcessHeap
HeapFree
HeapAlloc
FreeLibrary
GetVersionExA
LoadLibraryA
GetProcAddress
GetWindowsDirectoryA
WriteConsoleW
HeapSize
FlushFileBuffers
WriteConsoleA
VirtualFree
HeapCreate
DeleteCriticalSection
GetFileType
SetHandleCount
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetCommandLineA
GetStartupInfoA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
ExitProcess
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
user32
FillRect
LoadBitmapA
LoadIconA
ExitWindowsEx
SendMessageA
SendDlgItemMessageA
IsDialogMessageA
TranslateMessage
GetWindowLongA
CreateWindowExA
GetDlgItem
DefWindowProcA
SetWindowPos
ShowWindow
DispatchMessageA
AdjustWindowRectEx
SystemParametersInfoA
SetWindowTextA
UpdateWindow
LoadCursorA
PostQuitMessage
RegisterClassExA
GetWindowRect
GetMessageA
DestroyWindow
EndPaint
BeginPaint
gdi32
BitBlt
GetTextExtentPoint32A
SetTextColor
DeleteDC
CreateFontA
SetBkMode
SelectObject
CreateCompatibleDC
GetObjectA
GetStockObject
CreateSolidBrush
TextOutA
advapi32
RegDeleteKeyA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegDeleteValueA
RegQueryInfoKeyA
RegOpenKeyExA
RegCloseKey
RegCreateKeyA
RegQueryValueExA
shell32
SHFileOperationA
ShellExecuteA
SHGetFolderPathA
Sections
CODE Size: 53KB - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
DATA Size: 4KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 148KB - Virtual size: 148KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ