Static task
static1
Behavioral task
behavioral1
Sample
1016b2dd87db44eccc0211303c859a71_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1016b2dd87db44eccc0211303c859a71_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
1016b2dd87db44eccc0211303c859a71_JaffaCakes118
-
Size
275KB
-
MD5
1016b2dd87db44eccc0211303c859a71
-
SHA1
e2933aad23b7919c90a57364cc7dcc7f2b6b90d6
-
SHA256
c4996fc70f1923212a78c2e5ec94bfcace0c28d650777f3cab93826a1da333af
-
SHA512
3bfd6e5bcc3b1077709dc4c578cb0e8876bb9f3357a95b334ae92736c05e186c423bd30204b2cb8e8d135552f27c343fe3eb3afa43988f06b0e610bb8e4f7deb
-
SSDEEP
6144:iN/HLlhG/8jNQMyTfyZ1wafKa7Rs7PuJK6:iNpdNBEeK43
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1016b2dd87db44eccc0211303c859a71_JaffaCakes118
Files
-
1016b2dd87db44eccc0211303c859a71_JaffaCakes118.exe windows:4 windows x86 arch:x86
521589f4452e343b202bc6e52405aa77
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
gdi32
GetBitmapBits
DeleteObject
BitBlt
GetDeviceCaps
CreateCompatibleBitmap
GetObjectA
CreateCompatibleDC
DeleteDC
SelectObject
CreateDCA
wininet
InternetTimeFromSystemTimeA
kernel32
GetCurrentThreadId
EnterCriticalSection
GetFileSize
MapViewOfFile
UnhandledExceptionFilter
DisableThreadLibraryCalls
FindResourceW
HeapSize
CreateFileW
SystemTimeToFileTime
LocalFree
SetLastError
HeapDestroy
LoadResource
FreeLibrary
WideCharToMultiByte
CloseHandle
HeapReAlloc
LocalAlloc
GetSystemTime
DeleteCriticalSection
LockResource
GetSystemTimeAsFileTime
GetProcessHeap
UnmapViewOfFile
GlobalFree
HeapFree
IsDebuggerPresent
lstrlenA
SetUnhandledExceptionFilter
GetTempPathW
HeapAlloc
LeaveCriticalSection
FindResourceExW
GetTempFileNameW
SizeofResource
OutputDebugStringW
lstrlenW
LoadLibraryExW
RaiseException
ReadFile
CreateFileMappingW
TlsAlloc
VirtualAllocEx
IsBadWritePtr
userenv
GetAllUsersProfileDirectoryA
RegisterGPNotification
DestroyEnvironmentBlock
GetNextFgPolicyRefreshInfo
RefreshPolicyEx
RsopResetPolicySettingStatus
els
DllGetClassObject
Sections
.text Size: 224KB - Virtual size: 223KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.zOXAv Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.cHdMa Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.KOfWK Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.nvpMVbC Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 279KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Vgxl Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.kNtPJtC Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.XnlX Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.qMYDFcC Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gdxPFcC Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ErxaFcC Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.IOPFELA Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ