Static task
static1
Behavioral task
behavioral1
Sample
16393a862a194aad17c18d75a83464e7_JaffaCakes118.exe
Resource
win7-20231129-en
General
-
Target
16393a862a194aad17c18d75a83464e7_JaffaCakes118
-
Size
333KB
-
MD5
16393a862a194aad17c18d75a83464e7
-
SHA1
c51507cf8c6bdff2176ec7db9e30144a37a3354f
-
SHA256
d18302a5c4cf622a9d275fb0c4ca9a3b9d2868cf5e218d9d11e87ecd93292569
-
SHA512
7e024ac8f6522793ec29d292a66e70b9e119a0b6ba95a3062e42def76d557060ec62118a9cef0e8bb7354623adf50f773801c5cfdffac581e7f273fc136b12e4
-
SSDEEP
6144:RzLBxQnmjFCpOackuao16UrKXu6rb4SfFODUhC4xMK5bnQFz1j8F9b8e:RzLvFCp2kuaoM5+6rblfFOOCAMxe9z
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 16393a862a194aad17c18d75a83464e7_JaffaCakes118
Files
-
16393a862a194aad17c18d75a83464e7_JaffaCakes118.exe windows:4 windows x86 arch:x86
862ab366fd1a263098a63e8f65be7d83
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
_wcsicmp
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
_onexit
__dllonexit
?terminate@@YAXXZ
_except_handler3
_makepath
_wmakepath
wcscmp
wcscpy
_wcslwr
wcschr
malloc
free
puts
memmove
fprintf
_wsplitpath
_splitpath
fopen
vfprintf
fclose
sprintf
vswprintf
swprintf
wcslen
wcscat
strstr
vsprintf
__CxxFrameHandler
_wstati64
_stati64
_purecall
_ftol
??3@YAXPAX@Z
??2@YAPAXI@Z
toupper
atol
strtok
strncmp
strncpy
strncat
_stricmp
_strnicmp
kernel32
VirtualFree
VirtualAlloc
DeviceIoControl
IsBadWritePtr
ResetEvent
QueryDosDeviceA
GetVersionExA
CreateFileA
WideCharToMultiByte
CreateFileW
OutputDebugStringA
OutputDebugStringW
MultiByteToWideChar
FindFirstFileA
FindFirstFileW
GetTempFileNameA
GetTempFileNameW
DeleteFileA
DeleteFileW
CreateDirectoryA
CreateDirectoryW
CloseHandle
ReadFile
SetEndOfFile
WriteFile
SetFilePointer
GetLastError
GetTempPathW
CreateMutexA
InterlockedDecrement
GetCurrentThread
GetCurrentThreadId
lstrcmpiA
GetCommandLineA
GetModuleFileNameA
lstrlenA
InitializeCriticalSection
DeleteCriticalSection
lstrlenW
InterlockedIncrement
GetShortPathNameA
GetModuleHandleA
FreeLibrary
GetProcAddress
LoadLibraryA
lstrcpyA
lstrcatA
GetCurrentProcess
LeaveCriticalSection
EnterCriticalSection
WaitForSingleObject
GetDriveTypeW
GetDriveTypeA
CreateThread
SearchPathA
SetEvent
GetFileSize
GetVolumeInformationA
GetStartupInfoA
CreateEventA
user32
DispatchMessageA
MessageBoxA
GetMessageA
LoadStringA
CharNextA
MessageBoxW
wsprintfA
PostThreadMessageA
advapi32
OpenProcessToken
GetTokenInformation
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
GetLengthSid
CopySid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
ControlService
DeleteService
CreateServiceA
StartServiceCtrlDispatcherA
OpenThreadToken
SetServiceStatus
RegisterServiceCtrlHandlerA
RegisterEventSourceA
ReportEventA
DeregisterEventSource
OpenSCManagerA
OpenServiceA
CloseServiceHandle
RegDeleteValueA
RegDeleteValueW
RegEnumKeyExA
RegEnumKeyExW
RegEnumValueA
RegEnumValueW
RegCloseKey
RegEnumKeyW
RegEnumKeyA
RegDeleteKeyW
RegDeleteKeyA
RegSetValueExW
RegSetValueExA
RegCreateKeyExW
RegCreateKeyExA
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExW
RegOpenKeyExA
shell32
SHGetSpecialFolderPathW
SHGetSpecialFolderPathA
ole32
CoUninitialize
CoRevokeClassObject
CoInitializeSecurity
CoInitialize
CoCreateInstance
CoRegisterClassObject
CoDisconnectObject
oleaut32
LoadTypeLi
LoadRegTypeLi
SysStringLen
SysFreeString
SysAllocString
RegisterTypeLi
shlwapi
PathFileExistsA
PathFileExistsW
winmm
timeGetTime
Sections
.text Size: 204KB - Virtual size: 203KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 16KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 16KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 88KB - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE