Static task
static1
Behavioral task
behavioral1
Sample
23dd81096cf138214db8ff7e630e8e6d_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
23dd81096cf138214db8ff7e630e8e6d_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
23dd81096cf138214db8ff7e630e8e6d_JaffaCakes118
-
Size
57KB
-
MD5
23dd81096cf138214db8ff7e630e8e6d
-
SHA1
4ea7419c151f4e9a22ca9f88ee20f0ee27c1d90c
-
SHA256
35269f00ead12536f148a1c7805fd13158ee8e1e1d62e609890c0b2dfaf85cb5
-
SHA512
ad3b703255818ba476fbd3876e7ac1d081af2970c57e11002493660fec81c7842b4192b3b5f4c721195cc30abab13ceafb3121210d6ce2b255a5901c63ef9237
-
SSDEEP
1536:bi2WjncIgY+vyDek5weBSXtqle1T7wnIm:+2WTQZUekBYXtqgBkt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 23dd81096cf138214db8ff7e630e8e6d_JaffaCakes118
Files
-
23dd81096cf138214db8ff7e630e8e6d_JaffaCakes118.exe windows:4 windows x86 arch:x86
c28c37093af0adb922247533c0473507
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
ControlService
GetSecurityDescriptorControl
InitializeSecurityDescriptor
LockServiceDatabase
RegCreateKeyExA
RegEnumKeyExA
RegEnumValueA
RegOpenKeyA
UnlockServiceDatabase
kernel32
CreateDirectoryA
CreateFileA
CreateFileMappingA
CreateThread
CreateToolhelp32Snapshot
DeleteCriticalSection
DisableThreadLibraryCalls
DuplicateHandle
EnterCriticalSection
ExitProcess
ExpandEnvironmentStringsA
FormatMessageA
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetConsoleOutputCP
GetCurrentDirectoryA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDateFormatA
GetEnvironmentVariableA
GetLastError
GetLocalTime
GetModuleFileNameA
GetModuleHandleA
GetPrivateProfileSectionNamesA
GetPrivateProfileStringA
GetProcAddress
GetProcessHeap
GetStartupInfoA
GetStdHandle
GetStringTypeA
GetSystemDirectoryA
GetTempFileNameA
GetTickCount
GetTimeFormatA
GetVersionExA
GlobalAlloc
GlobalReAlloc
GlobalUnlock
HeapCreate
HeapDestroy
InitializeCriticalSection
InterlockedCompareExchange
InterlockedIncrement
IsBadCodePtr
IsBadWritePtr
IsDebuggerPresent
IsValidCodePage
IsValidLocale
LeaveCriticalSection
LoadLibraryA
LoadLibraryExA
LoadResource
LocalFree
MoveFileExA
QueryPerformanceCounter
RaiseException
ReadProcessMemory
ReleaseMutex
RemoveDirectoryA
SetEvent
SetFilePointer
SetLastError
SetStdHandle
SetThreadPriority
SetUnhandledExceptionFilter
SystemTimeToFileTime
TlsAlloc
TlsGetValue
UnhandledExceptionFilter
UnmapViewOfFile
VirtualQuery
lstrlenA
user32
DestroyIcon
DestroyWindow
DrawTextA
FillRect
FindWindowA
GetDC
GetMenuItemCount
GetMessagePos
GetParent
GetWindowDC
IsWindowEnabled
LoadImageA
MapWindowPoints
MessageBoxA
MoveWindow
RegisterClipboardFormatA
RegisterWindowMessageA
SendDlgItemMessageA
SetCapture
SetRect
SetWindowLongA
SetWindowRgn
ShowWindow
TranslateMessage
UnregisterClassA
wsprintfA
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
Sections
.text Size: 23KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.CRT Size: 13KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.edata Size: 15KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ