Static task
static1
Behavioral task
behavioral1
Sample
29280a9aceb1e8eafcfa4dfa532104ff_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
29280a9aceb1e8eafcfa4dfa532104ff_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
29280a9aceb1e8eafcfa4dfa532104ff_JaffaCakes118
-
Size
356KB
-
MD5
29280a9aceb1e8eafcfa4dfa532104ff
-
SHA1
578ab050d53abcddcf99ec760295dfd2da61f182
-
SHA256
d1eba1b89f481fc9f89fdc97ea4b2f9e12e52c9e2b41b6f31eafbe130152ee80
-
SHA512
2009d8902920d6ba204df1f940c7b7f962b1dc71e991ab5fec06041eb18455be7ed962f131f51acc13d229e7a6a09266f4813374a38f1b5cdb06a62f8e57016a
-
SSDEEP
6144:xZZlZ9hCLmsBxmS7TZwWK5o1gtBXhyAyUPWiGIBqxzpybSNlo+:TZlMbBEyGhyrUplKzpro
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 29280a9aceb1e8eafcfa4dfa532104ff_JaffaCakes118
Files
-
29280a9aceb1e8eafcfa4dfa532104ff_JaffaCakes118.exe windows:4 windows x86 arch:x86
7e5ad1a2a225a0fb7ab84b55a54e7412
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadResource
_lread
GetProcessTimes
GetSystemTimeAdjustment
QueryDosDeviceW
VirtualAllocEx
MoveFileExA
GetProfileStringA
IsBadReadPtr
SwitchToFiber
GetTapeParameters
SetStdHandle
CreateFileW
GetFullPathNameA
ReadConsoleOutputA
lstrcmpiW
SetupComm
ExitThread
SetFileAttributesA
VirtualQuery
SetConsoleCursorPosition
SearchPathW
GetLongPathNameA
SetSystemTime
WriteProcessMemory
SetThreadAffinityMask
VirtualProtect
EnumSystemCodePagesA
ClearCommBreak
CreateIoCompletionPort
PurgeComm
GetSystemInfo
GetVersionExA
FormatMessageW
CompareStringA
DeleteFiber
WritePrivateProfileSectionW
ReadDirectoryChangesW
GetNumberFormatW
IsDBCSLeadByteEx
LeaveCriticalSection
SetThreadLocale
ReadFileScatter
CreateWaitableTimerA
SetCommTimeouts
GlobalFree
FindResourceExW
WaitNamedPipeA
GetEnvironmentStringsW
VirtualAlloc
WritePrivateProfileSectionA
GetTempFileNameA
GetConsoleCursorInfo
EndUpdateResourceA
EraseTape
SetTimeZoneInformation
lstrcpyA
DebugBreak
ExpandEnvironmentStringsW
WritePrivateProfileStructA
GetCommandLineA
lstrlenA
GetConsoleMode
ExitProcess
user32
DeleteMenu
DrawFrameControl
CharToOemBuffA
LookupIconIdFromDirectory
IsRectEmpty
ArrangeIconicWindows
InsertMenuW
IsChild
TrackMouseEvent
CreateCaret
SystemParametersInfoA
GetDialogBaseUnits
GetSysColorBrush
BroadcastSystemMessageA
GetMonitorInfoW
IsIconic
DrawCaption
OemToCharA
DrawIcon
SetScrollInfo
IsCharAlphaW
GetCaretPos
GetMenuDefaultItem
EnumDisplayMonitors
LoadKeyboardLayoutA
TabbedTextOutW
GetCursorPos
CreateMDIWindowW
ReleaseCapture
GetKeyboardLayoutNameW
PtInRect
GetKeyState
MessageBeep
SwapMouseButton
CreateDialogIndirectParamA
ScreenToClient
gdi32
RemoveFontResourceW
ExtSelectClipRgn
DeleteObject
comdlg32
GetOpenFileNameW
PageSetupDlgW
PrintDlgA
FindTextA
advapi32
RegSaveKeyW
LookupPrivilegeValueA
OpenEventLogW
GetSidSubAuthorityCount
SetSecurityDescriptorSacl
RegSaveKeyA
MakeSelfRelativeSD
AbortSystemShutdownW
RegEnumKeyW
StartServiceCtrlDispatcherW
CryptAcquireContextW
OpenThreadToken
LogonUserA
GetFileSecurityW
AddAce
RegDeleteValueW
GetSecurityDescriptorGroup
RegDeleteKeyA
EnumDependentServicesW
LookupPrivilegeNameA
FreeSid
RegDeleteKeyW
EnumDependentServicesA
shell32
SHLoadInProc
SHFileOperationW
SHGetPathFromIDListA
Shell_NotifyIconA
SHGetSettings
DragFinish
ole32
CoInitializeEx
ReadClassStm
StringFromGUID2
CoMarshalInterThreadInterfaceInStream
CLSIDFromString
CoReleaseServerProcess
comctl32
ImageList_BeginDrag
CreateToolbarEx
shlwapi
StrCmpNA
Sections
.text Size: 332KB - Virtual size: 330KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE