Static task
static1
Behavioral task
behavioral1
Sample
0c63078f5f613e099f07ba785c33157a_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
0c63078f5f613e099f07ba785c33157a_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
0c63078f5f613e099f07ba785c33157a_JaffaCakes118
-
Size
196KB
-
MD5
0c63078f5f613e099f07ba785c33157a
-
SHA1
7ed25dcdd894d6035425bc45c48b26337d5fd448
-
SHA256
c4cf9f308e54e71416ee0456c36232b93118cde74462a2670ff4af88a23d287e
-
SHA512
6bd52124520a375607447b2747d2b4069acc61b06a15162ad81befedb3aadf45012593765b1bc5eb66ec37c923c6aaec9a30d07486ff65ff0be208c71a2d2e45
-
SSDEEP
3072:iLZZeYGlLomMtgLBZjwlHxHrQgWRawqjWolDfSf1YsSl1Kz:hHnZL/uHlWRawuHRfSf1oe
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0c63078f5f613e099f07ba785c33157a_JaffaCakes118
Files
-
0c63078f5f613e099f07ba785c33157a_JaffaCakes118.exe windows:4 windows x86 arch:x86
576ea2b497f06c3fed488e86ffdeb0c9
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetPrivateProfileStringA
CreateThread
lstrcpynA
WaitForSingleObject
FreeLibrary
GetSystemDirectoryA
GetTempPathA
GetModuleFileNameA
DebugBreak
OutputDebugStringA
GetThreadLocale
GetStringTypeExA
WinExec
InterlockedIncrement
InterlockedDecrement
TerminateThread
lstrcmpiA
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
OpenProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
HeapAlloc
EnterCriticalSection
GetSystemDefaultLangID
lstrlenA
LeaveCriticalSection
ExitProcess
DeleteCriticalSection
HeapDestroy
GetCurrentThreadId
ReleaseMutex
CloseHandle
CreateMutexA
LoadLibraryA
GetCurrentProcess
GetProcAddress
CopyFileA
HeapCreate
FlushInstructionCache
InitializeCriticalSection
CreateFileA
GetSystemInfo
lstrcpyA
lstrcmpA
GetACP
GetOEMCP
GetLastError
FreeEnvironmentStringsW
GetCPInfo
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
WriteFile
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
LCMapStringW
FreeEnvironmentStringsA
UnhandledExceptionFilter
TerminateProcess
IsBadWritePtr
VirtualAlloc
VirtualFree
GetVersion
GetCommandLineA
GetStartupInfoA
GetModuleHandleA
HeapReAlloc
RtlUnwind
HeapFree
LCMapStringA
user32
CreateDialogParamA
ShowWindow
MoveWindow
DestroyWindow
GetWindowLongA
SetWindowLongA
IsDialogMessageA
SetTimer
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
SetWindowTextA
PostQuitMessage
UpdateWindow
LoadImageA
CharNextA
KillTimer
LoadStringA
DefWindowProcA
CallWindowProcA
wvsprintfA
SetWindowPos
SetClassLongA
LoadCursorA
GetSystemMetrics
GetClassInfoExA
wsprintfA
RegisterClassExA
CreateWindowExA
InvalidateRect
PtInRect
BeginPaint
GetDC
ReleaseDC
DrawTextA
DrawIconEx
EndPaint
GetClientRect
SystemParametersInfoA
SendMessageA
gdi32
DeleteObject
SelectObject
CreateCompatibleDC
StretchBlt
SetBkMode
SetTextColor
GetTextExtentPoint32A
DPtoLP
GetDeviceCaps
CreateFontIndirectA
DeleteDC
GetObjectA
advapi32
AdjustTokenPrivileges
RegCloseKey
RegCreateKeyExA
RegQueryValueExA
RegOpenKeyExA
LookupPrivilegeValueA
OpenProcessToken
shell32
ShellExecuteA
ole32
CoInitialize
CoUninitialize
imagehlp
ImageRvaToVa
comctl32
InitCommonControlsEx
Sections
.text Size: 44KB - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128KB - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ