Static task
static1
Behavioral task
behavioral1
Sample
26a95562fd9b947102bf002e598a8150_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
26a95562fd9b947102bf002e598a8150_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
26a95562fd9b947102bf002e598a8150_JaffaCakes118
-
Size
316KB
-
MD5
26a95562fd9b947102bf002e598a8150
-
SHA1
3b6adaffe3ab6026f37b0b859af5b3efc19c928b
-
SHA256
7ba3b177725366cdb4342b2cb05354bbcf1ccf5312eef532c81ca42dec4bb050
-
SHA512
84c64287ababc8e0d2d8e7a2923ca7ccec634083902bdf4c5956beab69f252397fe3b35f1cc4755d8edf25d2f4cb1a47f098638f60853290f584f7cfeac81d8c
-
SSDEEP
6144:S+d+ObpYD50GF0km/IK1J3VdJVyTLt1YretMGgXC/57ssIx:nb9GF0km/5J3NVynTMGgS/BHIx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 26a95562fd9b947102bf002e598a8150_JaffaCakes118
Files
-
26a95562fd9b947102bf002e598a8150_JaffaCakes118.exe windows:4 windows x86 arch:x86
df95dfed166a4c7c64043d28e87da184
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
MoveFileW
CreateMutexA
GetSystemTimeAdjustment
SetEndOfFile
GetCPInfo
CreateFileW
ScrollConsoleScreenBufferA
GlobalFindAtomA
GetEnvironmentVariableW
SetNamedPipeHandleState
CloseHandle
FindFirstFileExW
GetLongPathNameA
VirtualAllocEx
ReadDirectoryChangesW
OutputDebugStringW
GetTempPathW
FindNextChangeNotification
GetShortPathNameA
GetPrivateProfileStringW
ConnectNamedPipe
VirtualLock
SetLastError
GetVersionExA
GetCommandLineA
VirtualProtect
GetHandleInformation
VirtualQueryEx
ReadConsoleOutputA
SuspendThread
lstrcmpiW
SetEnvironmentVariableW
EraseTape
SetProcessShutdownParameters
LoadLibraryExW
GetCommConfig
FreeLibraryAndExitThread
FreeEnvironmentStringsA
IsBadWritePtr
ClearCommBreak
lstrcmpiA
FindCloseChangeNotification
GetTapeStatus
GetEnvironmentStringsW
GetCommModemStatus
GlobalFree
_lclose
WritePrivateProfileStringW
GetVersion
GetNumberFormatW
SetMailslotInfo
MoveFileExA
GetProcessTimes
GetCommState
ExitProcess
user32
ShowOwnedPopups
DestroyWindow
EnableScrollBar
RegisterClassW
TranslateAcceleratorW
OemToCharA
GetClientRect
ScrollWindow
SetRectEmpty
LoadIconA
SetFocus
GetClipboardFormatNameW
GetKeyboardLayoutNameW
GetKeyboardLayoutNameA
IsZoomed
MapVirtualKeyA
ClientToScreen
GetSubMenu
LoadCursorA
ScreenToClient
MonitorFromPoint
CallWindowProcW
SetPropW
gdi32
ArcTo
GetLayout
CreateSolidBrush
DeleteMetaFile
advapi32
AddAccessAllowedAce
ImpersonateLoggedOnUser
DeregisterEventSource
RegSetValueW
OpenServiceW
ClearEventLogW
DuplicateTokenEx
GetSecurityDescriptorDacl
CryptDeriveKey
GetSecurityInfo
DeleteAce
SetTokenInformation
CreateProcessAsUserA
LogonUserW
InitializeSid
BuildTrusteeWithSidW
BuildTrusteeWithNameW
RegConnectRegistryW
RegisterServiceCtrlHandlerW
RegisterServiceCtrlHandlerA
LookupPrivilegeValueA
SetSecurityDescriptorSacl
RegDeleteKeyA
DestroyPrivateObjectSecurity
shell32
SHGetSpecialFolderLocation
FindExecutableA
Shell_NotifyIconW
ShellExecuteA
ole32
OleConvertIStorageToOLESTREAM
CoResumeClassObjects
OleSetClipboard
MkParseDisplayName
CoRegisterClassObject
CoTaskMemRealloc
oleaut32
SafeArrayRedim
VariantCopy
SafeArrayPutElement
SysStringLen
setupapi
SetupGetStringFieldA
SetupGetBinaryField
SetupIterateCabinetW
SetupDiOpenDevRegKey
SetupDiGetClassDevsA
SetupDiSetDeviceInstallParamsA
SetupDiOpenDeviceInterfaceW
SetupGetLineCountW
SetupDefaultQueueCallbackA
SetupDiGetDeviceRegistryPropertyW
SetupCommitFileQueueA
Sections
.text Size: 276KB - Virtual size: 275KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 32KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE