Static task
static1
Behavioral task
behavioral1
Sample
17c1b568f8850c62701cd218b1a187bb_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
17c1b568f8850c62701cd218b1a187bb_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
17c1b568f8850c62701cd218b1a187bb_JaffaCakes118
-
Size
469KB
-
MD5
17c1b568f8850c62701cd218b1a187bb
-
SHA1
13af3eef435da520bbb71209e42f0e9a661de2a4
-
SHA256
9aa3d13adfa086ce2b80fb2ea76462da959a91831f72986aeac17e031ceabf7b
-
SHA512
2c3e2c577fa4b31d69213344cd3bfa2c909ba5303f757fe45ffd34c83394e54753aacf483725bb78075773ff4156d56d27065acf8edfe3d0b874825170d1c9cc
-
SSDEEP
12288:/FiadP7BeqnmAPN3mrRXKv0H8ndob5KUQge/2u1esEB:9iadPEk3mr0vQ8ndowUQV/n1WB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 17c1b568f8850c62701cd218b1a187bb_JaffaCakes118
Files
-
17c1b568f8850c62701cd218b1a187bb_JaffaCakes118.exe windows:4 windows x86 arch:x86
a0d789fe576482f2dd4c2ae336ca582d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
RegisterClassA
SetTimer
RegisterClassExA
kernel32
SetLocaleInfoA
HeapReAlloc
FormatMessageW
SetFilePointer
WideCharToMultiByte
InterlockedDecrement
GetCurrentProcessId
IsBadWritePtr
GetCPInfo
ReadFile
AddAtomW
GetCommandLineW
OpenMutexA
GetEnvironmentStrings
LCMapStringA
GetLocalTime
LocalFlags
QueryPerformanceCounter
GetTickCount
CreateFileMappingA
LeaveCriticalSection
SetStdHandle
GetSystemTimeAsFileTime
DeleteCriticalSection
WriteConsoleInputW
TlsAlloc
GetMailslotInfo
GetEnvironmentStringsW
InterlockedIncrement
GetProcAddress
FreeEnvironmentStringsA
SetConsoleActiveScreenBuffer
GetFileType
EnterCriticalSection
GetCurrentThread
SetHandleCount
GetModuleFileNameA
ReleaseMutex
GetLastError
TlsGetValue
InitializeCriticalSection
GetSystemTime
HeapCreate
CreateMutexA
GetStdHandle
EnumDateFormatsExA
RtlUnwind
GetCurrentThreadId
GetEnvironmentStringsA
GetStringTypeA
FreeEnvironmentStringsW
GetCommandLineA
HeapAlloc
UnhandledExceptionFilter
GetStringTypeW
FindNextChangeNotification
LoadLibraryA
ExitProcess
GetTimeZoneInformation
TerminateProcess
GetModuleFileNameW
FindFirstFileExW
GetStartupInfoA
FoldStringA
WriteFile
CreateEventA
CompareStringA
VirtualFree
GetModuleHandleA
LCMapStringW
SetConsoleMode
TlsFree
FlushFileBuffers
SetConsoleTitleW
GetFullPathNameA
CloseHandle
GetStartupInfoW
SetLastError
GetVersion
VirtualQuery
HeapFree
TlsSetValue
GetCurrentProcess
SetEnvironmentVariableA
InterlockedExchange
MultiByteToWideChar
VirtualAlloc
ReadFileEx
HeapDestroy
CompareStringW
shell32
FreeIconList
SHGetInstanceExplorer
RealShellExecuteExW
SheChangeDirA
comctl32
InitCommonControlsEx
gdi32
SetBkMode
EndPage
GdiPlayScript
Rectangle
CloseMetaFile
AbortDoc
advapi32
RegQueryValueW
RegQueryValueExW
CryptSetKeyParam
CryptEnumProviderTypesW
CryptReleaseContext
LookupPrivilegeNameA
LookupPrivilegeNameW
InitializeSecurityDescriptor
CryptExportKey
CryptSetProviderA
RegDeleteValueW
RegQueryValueA
CryptGenRandom
CryptDuplicateHash
comdlg32
PrintDlgA
ChooseColorW
LoadAlterBitmap
FindTextA
Sections
.text Size: 312KB - Virtual size: 312KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 28KB - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 103KB - Virtual size: 102KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ