Static task
static1
Behavioral task
behavioral1
Sample
1b6154f7410a43bf51d555005dffb622_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
1b6154f7410a43bf51d555005dffb622_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
1b6154f7410a43bf51d555005dffb622_JaffaCakes118
-
Size
358KB
-
MD5
1b6154f7410a43bf51d555005dffb622
-
SHA1
e7091b715f1bbdac01c723f495af44ee94db1a6d
-
SHA256
509b3638efb367960f35ac663acfea46b84ba8de7159b0c501306e88c7bb5858
-
SHA512
1d2661da18b1e59f2f654449780282fbf0285c85ed595514cecb5839870589e0996c97d8fdd00284e3e62fb1b938a80cfe90be5443f58ac547afded27f9bda4c
-
SSDEEP
6144:w0JW9vrPaM2Y/Tohj7DxHlYvtYPVgZ2BVKR6rgemCywMXU7yw9:JJsmMj/MhPDJaVdKrgnX4x
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1b6154f7410a43bf51d555005dffb622_JaffaCakes118
Files
-
1b6154f7410a43bf51d555005dffb622_JaffaCakes118.exe windows:5 windows x86 arch:x86
a8f29cd51bcaf655e660286f12ddaa15
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
_except_handler3
strncpy
sprintf
wcscpy
wcsncpy
memmove
wcschr
wcslen
free
malloc
_initterm
_adjust_fdiv
kernel32
GetTempFileNameW
LoadLibraryA
MoveFileA
GetFileAttributesA
FileTimeToDosDateTime
WideCharToMultiByte
FreeLibrary
GetProcAddress
LoadLibraryW
lstrcpyW
CloseHandle
LocalFree
SetEvent
Sleep
InterlockedExchange
InterlockedCompareExchange
GetLastError
LocalAlloc
VerifyVersionInfoW
SetFileAttributesA
CreateEventW
WaitForSingleObject
ReleaseMutex
WaitForMultipleObjects
GetTickCount
SetThreadPriority
GetCurrentThread
CreateThread
GetCurrentThreadId
SetLastError
lstrlenW
SetFileAttributesW
CreateDirectoryW
GetFileAttributesW
CompareStringW
lstrcmpiW
lstrcatW
DeleteFileW
CreateFileW
WriteFile
ReadFile
SetFileTime
MoveFileW
SetEndOfFile
GetFileSize
SetFilePointer
GetVolumeInformationW
FindClose
FindFirstFileW
MultiByteToWideChar
RaiseException
GetDriveTypeW
GetEnvironmentVariableW
OutputDebugStringA
GetDiskFreeSpaceA
lstrcatA
GetWindowsDirectoryA
GlobalFree
OutputDebugStringW
CreateMutexW
GetCurrentProcess
ProcessIdToSessionId
GetCurrentProcessId
DuplicateHandle
QueryPerformanceCounter
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InterlockedIncrement
CreateFileA
InterlockedDecrement
DeviceIoControl
DeleteFileA
lstrcpyA
user32
GetMenu
wvsprintfA
MessageBoxA
CloseDesktop
wsprintfA
wsprintfW
MsgWaitForMultipleObjects
SetThreadDesktop
UnregisterClassW
CheckMenuItem
DefWindowProcW
PostQuitMessage
DestroyWindow
advapi32
RegDeleteValueW
RegQueryValueExA
OpenThreadToken
RevertToSelf
SetThreadToken
OpenProcessToken
DuplicateToken
GetTokenInformation
RegCreateKeyExW
GetLengthSid
RegCloseKey
RegOpenKeyA
RegCreateKeyExA
GetFileSecurityW
GetUserNameA
RegOpenKeyExW
RegQueryValueExW
RegOpenKeyExA
Sections
0 Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 844B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1024B - Virtual size: 90B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 331KB - Virtual size: 330KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 428KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ