Static task
static1
Behavioral task
behavioral1
Sample
104942af3b1c0a6b6744d65e1b7bfe48_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
104942af3b1c0a6b6744d65e1b7bfe48_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
104942af3b1c0a6b6744d65e1b7bfe48_JaffaCakes118
-
Size
104KB
-
MD5
104942af3b1c0a6b6744d65e1b7bfe48
-
SHA1
75aa3a7b90cea27d321dbfc9b8b9b49f539784b4
-
SHA256
e07252680e86957cff17793fab71dbc1e37f4bd059d1e8e02e62fe4f17e1c33d
-
SHA512
5291ce57ab79b655e010d27e7f847a4cd262e8b9ce070e0e84e1cc0033724d0a65cd71508cf9cd0f89459fbc0011cf8b6f9c085251a34f3b91a99383a46a6916
-
SSDEEP
3072:5AFvjL5rj9LBF4wsGUIJQJmgBRif1ooUY7LoLvC+:5wLd9VF4wsaQJmgrMjUKLS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 104942af3b1c0a6b6744d65e1b7bfe48_JaffaCakes118
Files
-
104942af3b1c0a6b6744d65e1b7bfe48_JaffaCakes118.exe windows:4 windows x86 arch:x86
bba8529aad7da3a46041136ed59eeb47
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
_wcsicmp
strcspn
tolower
fprintf
__getmainargs
__CxxFrameHandler
_acmdln
sqrt
__p__commode
_adjust_fdiv
_errno
abort
_except_handler3
bsearch
atoi
__setusermatherr
_fullpath
localeconv
puts
_lock
_lseeki64
exit
_exit
_initterm
__p__fmode
iswctype
_lseek
__set_app_type
_XcptFilter
kernel32
GetModuleHandleA
RaiseException
LCMapStringA
VirtualProtect
WaitForSingleObject
GetTimeZoneInformation
GetCurrentProcess
GetFileTime
GetCommandLineA
OutputDebugStringA
InterlockedDecrement
GetConsoleOutputCP
GetStartupInfoW
SystemTimeToFileTime
FreeEnvironmentStringsW
GetStartupInfoA
RemoveDirectoryA
Sleep
DuplicateHandle
GetVersion
GetCurrentDirectoryA
user32
ShowCursor
GetScrollPos
CallNextHookEx
GetIconInfo
IsWindowVisible
DeleteMenu
GetFocus
GetParent
SendDlgItemMessageA
GetSystemMetrics
SetClassLongA
GetCursorPos
GetSysColorBrush
SetActiveWindow
GetSysColor
oleaut32
CreateErrorInfo
SafeArrayRedim
SysStringLen
SafeArrayGetElement
SysStringByteLen
LoadTypeLib
SetErrorInfo
VariantCopyInd
SysFreeString
SysReAllocStringLen
GetErrorInfo
SafeArrayCreate
GetActiveObject
advapi32
InitializeAcl
GetUserNameA
InitiateSystemShutdownA
GetLengthSid
OpenProcessToken
RegEnumValueA
RegQueryValueExW
RegSetValueExW
CloseServiceHandle
DeleteService
RegEnumValueW
RegQueryInfoKeyW
IsValidSid
SetSecurityDescriptorGroup
GetTokenInformation
AddAccessAllowedAce
QueryServiceStatus
LookupPrivilegeValueA
FreeSid
RegDeleteKeyA
CryptDestroyHash
Sections
.text Size: 58KB - Virtual size: 57KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ