Static task
static1
Behavioral task
behavioral1
Sample
15e6800c8c54dfa0e3873242d9178f80_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
15e6800c8c54dfa0e3873242d9178f80_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
15e6800c8c54dfa0e3873242d9178f80_JaffaCakes118
-
Size
261KB
-
MD5
15e6800c8c54dfa0e3873242d9178f80
-
SHA1
79203bf3a6aaa17091a4871492470bb1ab8d137e
-
SHA256
70edc4f7b4409cd8e1b682ebc407623cc9f81a707114470df2047bdffcd62124
-
SHA512
971d0cd9d2f8d328303a4190b28323cc7fcb3029e4882d9841a566974500cc00e2e370b5f059e9c19edbf689b5896b2ca961b5544a4e24d0c12e6f231ca043ca
-
SSDEEP
6144:oQzsTbHBw8dumdsUJm+o1o+QJCiVX9e1Cc9:oQzsTby8dumdsKm+o1WX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 15e6800c8c54dfa0e3873242d9178f80_JaffaCakes118
Files
-
15e6800c8c54dfa0e3873242d9178f80_JaffaCakes118.exe windows:4 windows x86 arch:x86
e8bb0c09364cb5620899d85b8ebfe5c0
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
user32
MessageBoxW
ole32
CoCreateInstance
oleaut32
SysAllocString
VariantClear
SysFreeString
VariantInit
winmm
timeGetTime
kernel32
CloseHandle
GetSystemTimeAsFileTime
WriteFile
UnhandledExceptionFilter
LockResource
TlsAlloc
LeaveCriticalSection
TlsSetValue
GetOverlappedResult
HeapAlloc
GetSystemInfo
ReleaseSemaphore
GetStdHandle
lstrlenA
FindResourceExW
LoadResource
GetCommandLineW
HeapSize
SizeofResource
DeleteCriticalSection
UnregisterWaitEx
GetThreadTimes
WaitForSingleObjectEx
TlsGetValue
SetNamedPipeHandleState
SuspendThread
SetUnhandledExceptionFilter
OpenThread
CancelIo
GetModuleHandleW
GetThreadContext
HeapFree
EnterCriticalSection
GetProcessHeap
VirtualAlloc
CreateWaitableTimerW
SetThreadPriority
CreateEventW
FindResourceW
CreateSemaphoreA
WaitForSingleObject
GetFileType
IsDebuggerPresent
RaiseException
GetFileSize
GetCurrentThreadId
VirtualFree
HeapReAlloc
HeapDestroy
CancelWaitableTimer
ReadFile
OutputDebugStringA
RegisterWaitForSingleObject
CreateFileW
SetWaitableTimer
RtlCaptureContext
ResumeThread
GetTimeZoneInformation
HeapCreate
VirtualAllocEx
LocalAlloc
shlwapi
PathAddBackslashW
advapi32
ControlTraceW
TraceMessage
RegisterTraceGuidsW
RegEnumKeyW
GetTraceLoggerHandle
RegCloseKey
GetTraceEnableLevel
RegEnumValueW
RegOpenKeyExW
RegQueryValueExW
RegQueryInfoKeyW
GetTraceEnableFlags
UnregisterTraceGuids
dbghelp
MakeSureDirectoryPathExists
FindExecutableImage
WinDbgExtensionDllInit
SymUnloadModule64
UnDecorateSymbolName
SymGetSymFromAddr
MiniDumpWriteDump
ImageDirectoryEntryToData
pid
DllCanUnloadNow
Sections
.text Size: 115KB - Virtual size: 114KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.NXNO Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.zXmZYlw Size: 512B - Virtual size: 439B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 8KB - Virtual size: 77KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 110KB - Virtual size: 110KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.kSuEmql Size: 1024B - Virtual size: 823B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.BwKM Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rTpCDYW Size: 1024B - Virtual size: 631B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.jlbyy Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.cCVw Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ