Static task
static1
Behavioral task
behavioral1
Sample
105036344d0684a09c317939083284cf_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
105036344d0684a09c317939083284cf_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
105036344d0684a09c317939083284cf_JaffaCakes118
-
Size
176KB
-
MD5
105036344d0684a09c317939083284cf
-
SHA1
74d22d1d234795fa9b9f4d305c6cb410dc855df7
-
SHA256
fd5da794c820907732385eaa0ab2ee543802017abbb58937a05577e9f8e37ad1
-
SHA512
0c84fb26cabe17bcdd4ccfd136f8d6a26090352d3536e093ea15cf30b6b56a38fad5d29fa22e0e15c319062f0c2265f431eadd6d773904ab8b85bd32b6cfb6ab
-
SSDEEP
3072:h9+0+3kF7bjwLRCqUMshM4OKCTkuzGX4AhtopQp3A5U6+7ffhIzHjRzGE:D+lUF7bjoRCqyhTOKCTVzGhUjGCHRzB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 105036344d0684a09c317939083284cf_JaffaCakes118
Files
-
105036344d0684a09c317939083284cf_JaffaCakes118.exe windows:4 windows x86 arch:x86
2b0f90c8768a11b973a6d6041741fca6
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
odbc32
ord147
ord145
ord44
ord43
ord142
ord141
ord140
ord78
ord121
ord20
ord12
ord111
ord9
ord108
ord107
ord48
wsnmp32
ord905
ord904
ord903
ord902
ord901
ord900
ord606
ord401
ord400
ord320
ord302
ord106
ord105
ord104
ord100
kernel32
DeleteCriticalSection
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetLocaleInfoW
GetTimeZoneInformation
GetStringTypeW
GetStringTypeA
LoadLibraryA
GetProcAddress
GetOEMCP
GetACP
GetVersionExA
GetUserDefaultLCID
EnumSystemLocalesA
GetLocaleInfoA
IsValidCodePage
IsValidLocale
GetCPInfo
WriteFile
RtlUnwind
GetCurrentThread
GetLastError
TlsGetValue
SetLastError
TlsFree
TlsAlloc
TlsSetValue
GetCurrentThreadId
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
SetSystemPowerState
GetLocalTime
CreateFileA
SetTapePosition
lstrcmpA
GetSystemWindowsDirectoryA
InterlockedDecrement
InterlockedIncrement
HeapAlloc
GetCommandLineA
GetVersion
ExitProcess
HeapFree
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
LCMapStringW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
FatalAppExitA
Sleep
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
IsBadWritePtr
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
Sections
.text Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 68KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 60KB - Virtual size: 598KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ