Static task
static1
Behavioral task
behavioral1
Sample
27106576e84d58e89aec5b124cbc69d6_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
27106576e84d58e89aec5b124cbc69d6_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
27106576e84d58e89aec5b124cbc69d6_JaffaCakes118
-
Size
197KB
-
MD5
27106576e84d58e89aec5b124cbc69d6
-
SHA1
a97a3b950c5197b6af8236fcdcc24e935d5df645
-
SHA256
eb74c29ee23be84b69212817aa748aea8f6f9e6721da8c0d3a7bf62d63cbaa9d
-
SHA512
53ca562fe52b198d655cd83b0f0a6f830492dbc13d48d5cb49f7e3895ae4ceedef6bdc1205e2f0d01894e726db3fa294e1b346e1b7ecd165cceca52b05b4aa9e
-
SSDEEP
3072:OHv9xikCDq9cWwqjHUh7Yj/2+0QQubecvCkUE0TeNQlXZXTWM1xv:OHVxikCcLKNW5vCksHldTWev
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 27106576e84d58e89aec5b124cbc69d6_JaffaCakes118
Files
-
27106576e84d58e89aec5b124cbc69d6_JaffaCakes118.exe windows:5 windows x86 arch:x86
7e895cb8e98ed555a333d395bd36a54c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
HeapAlloc
GetProcessHeap
HeapFree
lstrcmpA
MultiByteToWideChar
lstrlenA
GetLastError
Sleep
SetLastError
CreateFileA
VirtualAlloc
VirtualFree
CreateMutexA
GetCommandLineA
CloseHandle
ReleaseMutex
WaitForSingleObject
CreateProcessA
GetModuleFileNameA
FindFirstVolumeA
GetVersionExA
lstrcatA
lstrlenW
GetCurrentProcess
WideCharToMultiByte
FindResourceW
SizeofResource
LockResource
LoadResource
FindResourceExW
CreateFileW
WriteConsoleW
SetStdHandle
GetConsoleMode
GetConsoleCP
SetFilePointer
LoadLibraryW
GetStringTypeW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapCreate
IsValidCodePage
GetOEMCP
GetACP
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetCurrentThreadId
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
ExitProcess
GetLocaleInfoW
GetModuleFileNameW
GetStdHandle
FlushFileBuffers
WriteFile
IsProcessorFeaturePresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
EncodePointer
DecodePointer
HeapDestroy
HeapReAlloc
HeapSize
RaiseException
InitializeCriticalSectionAndSpinCount
RtlUnwind
VirtualProtect
GetProcAddress
GetModuleHandleW
GetSystemInfo
VirtualQuery
HeapSetInformation
GetStartupInfoW
LCMapStringW
user32
PostQuitMessage
SetWindowPos
GetMessageA
RegisterClassExA
DefWindowProcA
GetWindowLongA
GetWindowRect
UpdateWindow
GetClientRect
CreateWindowExA
GetSystemMetrics
SetTimer
TranslateMessage
SetWindowLongA
ShowWindow
DispatchMessageA
KillTimer
ole32
OleInitialize
CoCreateInstance
oleaut32
VariantClear
SysAllocStringLen
SysAllocString
SysFreeString
shlwapi
StrStrA
urlmon
CoInternetSetFeatureEnabled
CoInternetIsFeatureEnabled
wininet
InternetReadFile
InternetConnectA
HttpOpenRequestA
HttpSendRequestA
InternetQueryDataAvailable
FindCloseUrlCache
DeleteUrlCacheEntry
FindNextUrlCacheEntryA
FindFirstUrlCacheEntryA
InternetCloseHandle
InternetOpenA
psapi
GetProcessMemoryInfo
Sections
.text Size: 143KB - Virtual size: 142KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 31KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 378KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ