Static task
static1
Behavioral task
behavioral1
Sample
244ba7a70b0ea885deb9ad87cf56482f_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
244ba7a70b0ea885deb9ad87cf56482f_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
244ba7a70b0ea885deb9ad87cf56482f_JaffaCakes118
-
Size
52KB
-
MD5
244ba7a70b0ea885deb9ad87cf56482f
-
SHA1
fe47ffb0d3f58032eb955fe7ea8a08c630d0497c
-
SHA256
0fd0447b8124dc79d56441c31908854fae4248d40426ec89fe1df7acef53a4be
-
SHA512
fbef56b6749ad1ac1d86a3485d1c2ab68d75debd15eb7a906be9aabdd88a75ccd85a12561a73903b0bb56cebec4430a26b7f76c2dc77f23fb74d4c4e015eb3d3
-
SSDEEP
1536:sQJ7EXI4aVZYzme4GnhHdKpkhwghJXLCOJwKdflt:sQJ7E44aVEme4GnVdKpkhwMXBPJlt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 244ba7a70b0ea885deb9ad87cf56482f_JaffaCakes118
Files
-
244ba7a70b0ea885deb9ad87cf56482f_JaffaCakes118.exe windows:4 windows x86 arch:x86
777279bb3789286450e50dab041c7d60
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
ChangeServiceConfig2A
CloseServiceHandle
DeleteService
LookupAccountSidA
QueryServiceConfig2A
RegQueryValueA
SetSecurityDescriptorDacl
SetServiceStatus
kernel32
CloseHandle
CompareStringA
CreateFileA
CreateFileMappingA
CreateProcessA
CreateThread
CreateToolhelp32Snapshot
DeleteCriticalSection
DisableThreadLibraryCalls
EnterCriticalSection
EnumSystemLocalesA
ExitProcess
FindClose
FindFirstFileA
FlushFileBuffers
FreeLibrary
GetCPInfo
GetCommandLineA
GetCurrentProcess
GetCurrentThread
GetCurrentThreadId
GetDriveTypeA
GetEnvironmentStringsA
GetFileSize
GetFileTime
GetFileType
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetOEMCP
GetPrivateProfileSectionA
GetShortPathNameA
GetStartupInfoA
GetTempPathA
GetTickCount
GetUserDefaultLCID
GetVersion
GetVersionExA
GlobalFree
GlobalReAlloc
HeapAlloc
HeapDestroy
HeapFree
HeapReAlloc
InitializeCriticalSection
InterlockedCompareExchange
InterlockedDecrement
InterlockedIncrement
IsBadReadPtr
IsBadWritePtr
IsDebuggerPresent
IsValidLocale
LeaveCriticalSection
LoadResource
LocalAlloc
LocalFree
Module32First
Module32Next
MoveFileA
MoveFileExA
MultiByteToWideChar
OpenProcess
OutputDebugStringA
RaiseException
ReadFile
RemoveDirectoryA
ResetEvent
SearchPathA
SetCurrentDirectoryA
SetEvent
SetFilePointer
SetFileTime
SetLastError
SetStdHandle
Sleep
TlsSetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WaitForSingleObject
WriteFile
lstrcatA
lstrcmpA
lstrcpyA
lstrlenA
user32
CharUpperA
CheckMenuItem
DialogBoxParamA
DispatchMessageA
EnableMenuItem
FindWindowA
GetActiveWindow
GetAsyncKeyState
GetClientRect
GetDC
GetDesktopWindow
GetDlgItem
GetDlgItemTextA
GetMessageA
GetSystemMenu
GetWindowLongA
IsChild
LoadImageA
MessageBoxA
RegisterClassA
RegisterWindowMessageA
ReleaseCapture
ScreenToClient
SendMessageA
SetForegroundWindow
SetWindowLongA
SystemParametersInfoA
UnregisterClassA
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
Sections
.text Size: 17KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.INIT Size: 13KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.edata Size: 15KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ