Static task
static1
Behavioral task
behavioral1
Sample
0fcd9d40bdd97dd7bcde4fd1d2b98a47_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
0fcd9d40bdd97dd7bcde4fd1d2b98a47_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
0fcd9d40bdd97dd7bcde4fd1d2b98a47_JaffaCakes118
-
Size
948KB
-
MD5
0fcd9d40bdd97dd7bcde4fd1d2b98a47
-
SHA1
bc3fad011a5ce9c5a4bd85d7b523b19ba511fc85
-
SHA256
ff3719fb5fdc38a2ac5dcd3f0eaa0682d318436afde602fe6210fe631dcd7a2a
-
SHA512
240a8f60398daa1f657941a7b89b2e9cb0576bfbe9f0cb33b5a745f09ca2a3f12cdbdac3f8edd6dba72dfd552c32a0bb4e65e3644d11628e326c16e372c08c9f
-
SSDEEP
24576:nZrHCkQoQ1NZmj5ff6MawvdW9CoTduqJe2rJ7k:ZGkQogbmj5n6RMoZuMe2+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0fcd9d40bdd97dd7bcde4fd1d2b98a47_JaffaCakes118
Files
-
0fcd9d40bdd97dd7bcde4fd1d2b98a47_JaffaCakes118.exe windows:5 windows x86 arch:x86
d37b6cff9f06f41bd8b3a1a97ce6a4d2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ole32
CoRegisterSurrogate
OleIsRunning
CoGetStdMarshalEx
CoRegisterMessageFilter
OleIsCurrentClipboard
CoLockObjectExternal
CoFreeUnusedLibraries
CoAddRefServerProcess
CoRevokeClassObject
CoLoadLibrary
CoCreateGuid
OleSetMenuDescriptor
OleDestroyMenuDescriptor
CoRegisterMallocSpy
CoGetMalloc
OleTranslateAccelerator
BindMoniker
OleSetClipboard
CoGetObjectContext
CoInstall
CoTaskMemAlloc
OleQueryCreateFromData
OleCreateDefaultHandler
kernel32
GetCurrentProcessId
GetModuleHandleW
GetCurrentThreadId
GetTickCount
GetSystemTimeAsFileTime
GetOEMCP
InitAtomTable
GetConsoleCursorInfo
GetConsoleAliasExesW
QueryDosDeviceA
OpenThread
LocalReAlloc
SetFilePointerEx
CreateMutexA
EnumLanguageGroupLocalesA
ProcessIdToSessionId
lstrcmpiW
SetConsoleNumberOfCommandsA
SetMessageWaitingIndicator
CreateTapePartition
GlobalGetAtomNameA
RegisterWaitForSingleObject
IsDBCSLeadByteEx
ReleaseMutex
GetFullPathNameW
CommConfigDialogW
ntdll
_aullrem
RtlNewSecurityObjectEx
ZwConnectPort
ZwSetSecurityObject
ZwIsSystemResumeAutomatic
NtProtectVirtualMemory
wcsspn
NtLoadKey2
__toascii
NtCreateSymbolicLinkObject
RtlTraceDatabaseDestroy
RtlStringFromGUID
NtAccessCheckByTypeAndAuditAlarm
RtlFindSetBits
RtlAddAuditAccessAceEx
ZwAccessCheck
RtlIsValidIndexHandle
Sections
.text Size: 67KB - Virtual size: 67KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 992B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ