Static task
static1
Behavioral task
behavioral1
Sample
294bc9b6e7acedf989bdd4e15353f2a1_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
294bc9b6e7acedf989bdd4e15353f2a1_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
294bc9b6e7acedf989bdd4e15353f2a1_JaffaCakes118
-
Size
183KB
-
MD5
294bc9b6e7acedf989bdd4e15353f2a1
-
SHA1
bebe4010dd2e14cb32f63aad32c516afb850d2af
-
SHA256
c847168a1a48f6632b45d58f698db7f9fafe7319b048d9d92678068980f1ded5
-
SHA512
64f29109e67f010795d73fb6c94049600341a9c035db691c0b37f7abf00156b888cab6e45eeabe7569f20b6dd207e961dccb495d46e5b01a7cf7659f0b9a3425
-
SSDEEP
3072:4yKpB5KbINU4xzPwj3Az5pXRamcaTDM37AsLZCKVSk4C+NtgRP7p3/JHZsaFfhhs:4cINUyzPwKpJTI3f1VK/NsP7F/JHZFhu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 294bc9b6e7acedf989bdd4e15353f2a1_JaffaCakes118
Files
-
294bc9b6e7acedf989bdd4e15353f2a1_JaffaCakes118.exe windows:4 windows x86 arch:x86
3e7f15705a36374e14dbe74a06a35357
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_DEBUG_STRIPPED
Imports
quartz
AMGetErrorTextW
ole32
CreateItemMoniker
CLSIDFromString
StringFromGUID2
CoUninitialize
CoRevokeClassObject
CoTaskMemFree
CoCreateInstance
CoInitializeEx
GetRunningObjectTable
CoRegisterClassObject
CoInitialize
StringFromCLSID
CreateStreamOnHGlobal
CoFreeUnusedLibraries
CoTaskMemAlloc
winmm
timeBeginPeriod
timeGetTime
timeGetDevCaps
timeEndPeriod
shell32
SHGetSpecialFolderPathA
user32
GetMessageA
wvsprintfA
wsprintfA
LoadStringA
MsgWaitForMultipleObjects
PostThreadMessageA
CreateWindowExA
RegisterWindowMessageA
GetQueueStatus
PeekMessageA
DispatchMessageA
CopyRect
MonitorFromWindow
RegisterClassA
DestroyWindow
kernel32
WaitForSingleObject
GetTickCount
GetVersionExA
HeapFree
CloseHandle
ResetEvent
GetTapeParameters
LocalFree
GetSystemInfo
lstrlenA
GetThreadPriority
DeleteCriticalSection
MultiByteToWideChar
GetCurrentProcessId
GetSystemTime
GetExitCodeThread
LoadLibraryA
ClearCommError
GetSystemTimeAsFileTime
GetModuleFileNameW
InterlockedDecrement
InterlockedIncrement
GetModuleFileNameA
GetCurrentThreadId
EnumResourceNamesA
CreateFileW
ResumeThread
WideCharToMultiByte
FindResourceA
DisableThreadLibraryCalls
LoadLibraryW
LockResource
GlobalAlloc
QueryPerformanceCounter
LeaveCriticalSection
IsBadWritePtr
CreateEventA
ReleaseSemaphore
SetEvent
CreateSemaphoreA
TerminateThread
FatalExit
Sleep
VirtualFree
InitializeCriticalSection
GetProcessHeap
GetACP
WaitForMultipleObjects
FreeLibrary
ReleaseMutex
CreateThread
GetCurrentThread
EnterCriticalSection
CreateMutexA
GetLastError
LoadResource
SetThreadPriority
VirtualAlloc
IsBadReadPtr
GetProcAddress
ExitProcess
advapi32
RegOpenKeyExA
RegCreateKeyA
RegCreateKeyExA
RegCloseKey
RegSetValueA
RegSetValueExA
RegDeleteKeyA
RegQueryValueExA
RegEnumKeyExA
Sections
.text Size: 131KB - Virtual size: 130KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 47KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.lib Size: 512B - Virtual size: 364KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ