Static task
static1
Behavioral task
behavioral1
Sample
094f1d1c1aa7378d73ef85e7f28b74cb_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
094f1d1c1aa7378d73ef85e7f28b74cb_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
094f1d1c1aa7378d73ef85e7f28b74cb_JaffaCakes118
-
Size
123KB
-
MD5
094f1d1c1aa7378d73ef85e7f28b74cb
-
SHA1
0a964f308555635ee18b4d91b399bbec143cbf37
-
SHA256
b569ae693af375ebcf3d75ff2c16c019cd6a7bb8a45bd66777ca0f44b8f43bfc
-
SHA512
d2fbd0a7ed7396b898352414d8558640bb4ebe14d13912af18097a3ffb2764ecace94fb5051a9e1a3076d711b4d9d412495f3586f428573f3fd64b4bc397d0ab
-
SSDEEP
3072:an3LVgfDt6fvMGIHTpwx0sKExMYcLTfjV0le:Sx3ETpwTK7YCrVh
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 094f1d1c1aa7378d73ef85e7f28b74cb_JaffaCakes118
Files
-
094f1d1c1aa7378d73ef85e7f28b74cb_JaffaCakes118.exe windows:4 windows x86 arch:x86
e00e343a3eed5445d839b709b6ed6b77
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateFileA
lstrcatA
GetSystemDirectoryA
ReadProcessMemory
GetCurrentProcess
GetProcAddress
GetModuleHandleA
lstrlenA
LoadLibraryA
FreeLibrary
GetModuleFileNameA
CloseHandle
GetTempPathA
LocalFree
CheckRemoteDebuggerPresent
ContinueDebugEvent
WaitForDebugEvent
CreateProcessA
IsDebuggerPresent
LocalAlloc
lstrcmpA
WriteFile
ExitProcess
GetLastError
DeleteFileA
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
Sleep
VirtualAlloc
HeapReAlloc
RtlUnwind
HeapSize
MultiByteToWideChar
GetLocaleInfoA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
user32
MessageBoxA
advapi32
GetUserNameA
RegOpenKeyExA
Sections
.text Size: 29KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.mydoc Size: 22KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 70KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ