Static task
static1
Behavioral task
behavioral1
Sample
1970cbebbba04493e6ef78d9fe8cd39c_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
1970cbebbba04493e6ef78d9fe8cd39c_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
1970cbebbba04493e6ef78d9fe8cd39c_JaffaCakes118
-
Size
3.3MB
-
MD5
1970cbebbba04493e6ef78d9fe8cd39c
-
SHA1
04b7b3ab39b296a997508b64113a7f67353d2515
-
SHA256
507f820be2bcde35a006718e05e6ffabf4a090dd2a1e11c80685f921ca6f7055
-
SHA512
c1d757688ff07777892dcdc5bec7e337d89f1a4a34b11766e6e832f2acd27b6f0e3d7282483cefdf7e991f5ba74ab7b951844a74313580108468e1fcd9f9d633
-
SSDEEP
49152:FocBrm+3tc7g59uG0oR6TtZza0xKATpAwAWxyXp3/U7gALs0u:frVtc71vjTfa6K+Agwp3//ALl
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1970cbebbba04493e6ef78d9fe8cd39c_JaffaCakes118
Files
-
1970cbebbba04493e6ef78d9fe8cd39c_JaffaCakes118.exe windows:1 windows x86 arch:x86
5bbe1d53c464c224fee31bdd6c155ca2
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetSystemWindowsDirectoryA
GetNativeSystemInfo
GetComputerNameA
IsBadReadPtr
GetModuleHandleExA
Sleep
CreateDirectoryA
CreateFileA
FindClose
FindFirstFileA
FindNextFileA
GetFileSizeEx
RemoveDirectoryA
SetEndOfFile
SetFilePointerEx
WriteFile
CloseHandle
GetLastError
ReleaseSemaphore
ReleaseMutex
WaitForSingleObject
CreateMutexA
GetProcessTimes
SwitchToThread
MapViewOfFileEx
UnmapViewOfFile
GetProcAddress
LocalFree
FormatMessageA
CreateSemaphoreA
CreateFileMappingA
OpenProcess
GetSystemTimeAsFileTime
MultiByteToWideChar
WideCharToMultiByte
SetCurrentDirectoryA
GetFileAttributesA
GetFullPathNameA
GetSystemTime
FileTimeToSystemTime
GetTimeZoneInformation
FreeLibrary
GetStdHandle
GetConsoleMode
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetFileTime
GetSystemDirectoryA
FlushFileBuffers
GetFileTime
ReadFile
SetFilePointer
QueryPerformanceCounter
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCPInfo
ExitProcess
GetModuleHandleW
GetModuleHandleExW
CreateFileW
GetFileType
RaiseException
HeapReAlloc
GetStringTypeW
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetConsoleCP
SetStdHandle
HeapSize
IsValidCodePage
GetOEMCP
GetModuleFileNameW
WriteConsoleW
EncodePointer
DecodePointer
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetDriveTypeA
GetCommandLineA
FindNextFileW
FindFirstFileExW
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwind
InitializeSListHead
GetWindowsDirectoryA
SetLastError
GetSystemInfo
GetModuleHandleA
GetModuleFileNameA
VirtualQuery
VirtualProtect
GetVersionExA
SetPriorityClass
SetThreadPriority
GetCurrentThread
TerminateProcess
HeapFree
GetCurrentDirectoryA
SetConsoleCtrlHandler
GetTickCount
GetACP
SystemTimeToFileTime
GetLocalTime
GetTempPathA
GetDiskFreeSpaceA
GetUserDefaultUILanguage
GetExitCodeThread
GetCurrentThreadId
DuplicateHandle
GetTickCount64
GetStartupInfoW
GetCurrentProcessId
GetCurrentProcess
GetProcessHeap
HeapAlloc
HeapCreate
GetCommandLineW
user32
LoadStringA
GetSystemMenu
CharUpperBuffA
CharLowerBuffA
GetSystemMetrics
MessageBoxA
DrawMenuBar
AppendMenuA
advapi32
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
ReadEventLogA
OpenEventLogA
CloseEventLog
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
CryptAcquireContextA
CryptReleaseContext
CryptGenRandom
Sections
__wibu00 Size: 604KB - Virtual size: 604KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
__wibu01 Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
__wibu02 Size: - Virtual size: 2KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
__wibu03 Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
__wibu04 Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
__wibu05 Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
__wibu06 Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
__wibu07 Size: 865KB - Virtual size: 868KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
__wibu08 Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
__wibu09 Size: 37KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
__wibu0a Size: 87KB - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE