Static task
static1
Behavioral task
behavioral1
Sample
2a3aa2b9fe231f5ff464083c87dd72d4_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2a3aa2b9fe231f5ff464083c87dd72d4_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
2a3aa2b9fe231f5ff464083c87dd72d4_JaffaCakes118
-
Size
328KB
-
MD5
2a3aa2b9fe231f5ff464083c87dd72d4
-
SHA1
1adfe6b3d181001be4e994ee91fbdac02380e748
-
SHA256
4b868ddf5fa633f01298603f1a61ce269352cc3e0324ada028544bc2e6035bbb
-
SHA512
62e12ec35e2fded884e0660e4cd3662616239b40d07240ccbf046feca601a82f44b77b47eb4e2f844a5a483792097fdf6dc231a4f1273f345230b30fd69bafeb
-
SSDEEP
6144:JtKNGLDAhedA9xBKVJTKwZAUoqaxwoD3fqV5d9bwEn6cCoZ1p/:JtKsahxB4JOTM2woD34wH0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2a3aa2b9fe231f5ff464083c87dd72d4_JaffaCakes118
Files
-
2a3aa2b9fe231f5ff464083c87dd72d4_JaffaCakes118.exe windows:4 windows x86 arch:x86
3864b693d8c18f480ac44b4222923e69
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
VirtualAlloc
CreateNamedPipeW
IsDBCSLeadByte
GetDiskFreeSpaceExA
SuspendThread
GetQueuedCompletionStatus
GetConsoleCursorInfo
ConvertThreadToFiber
GetUserDefaultLCID
LoadLibraryW
SetMailslotInfo
PrepareTape
FindCloseChangeNotification
GetVersionExA
TerminateThread
IsBadStringPtrW
LoadResource
GetCommandLineW
TryEnterCriticalSection
FillConsoleOutputAttribute
SetThreadLocale
VirtualProtect
lstrcatW
OutputDebugStringW
FileTimeToSystemTime
SetConsoleActiveScreenBuffer
GetLocalTime
VirtualFree
lstrlenW
SetThreadExecutionState
GlobalGetAtomNameW
SetConsoleMode
WaitForMultipleObjectsEx
FreeEnvironmentStringsW
WriteConsoleOutputW
TerminateProcess
GetProfileIntA
PurgeComm
LocalAlloc
WriteProcessMemory
DisconnectNamedPipe
FindResourceW
UnlockFileEx
QueryPerformanceFrequency
CompareStringA
CreateFileMappingA
GetTapeParameters
GetDateFormatA
GetConsoleTitleA
LoadLibraryA
ExpandEnvironmentStringsA
GetStdHandle
InterlockedExchange
TlsSetValue
IsDBCSLeadByteEx
SetProcessShutdownParameters
CreateDirectoryExA
GetStringTypeExW
FileTimeToDosDateTime
GetModuleFileNameA
GetCommandLineA
HeapSize
ExitProcess
user32
InflateRect
ActivateKeyboardLayout
GetWindow
GrayStringW
InvalidateRect
InvertRect
GetAsyncKeyState
SetWindowsHookExW
SetCaretPos
InSendMessage
LoadCursorFromFileW
SetDlgItemTextA
GetWindowRgn
GetWindowThreadProcessId
FindWindowExW
gdi32
EnumEnhMetaFile
Ellipse
EqualRgn
SetPaletteEntries
GetNearestPaletteIndex
CreateFontIndirectW
SelectObject
SetStretchBltMode
GetFontLanguageInfo
CloseMetaFile
MaskBlt
SetMapMode
CreateHatchBrush
GetTextColor
SetDIBits
Polyline
EnumFontFamiliesExA
comdlg32
GetOpenFileNameA
ChooseColorW
advapi32
RegConnectRegistryW
RegEnumKeyExW
RegOpenKeyExW
ObjectCloseAuditAlarmW
RegConnectRegistryA
ReportEventA
AddAccessDeniedAce
OpenEventLogW
GetCurrentHwProfileW
LogonUserW
SetThreadToken
RegQueryValueExA
GetTokenInformation
AccessCheckAndAuditAlarmA
RegDeleteValueA
RegReplaceKeyW
SetTokenInformation
FreeSid
AdjustTokenPrivileges
shell32
ExtractAssociatedIconA
ole32
WriteFmtUserTypeStg
CreateStreamOnHGlobal
CoReleaseMarshalData
oleaut32
GetErrorInfo
VariantCopyInd
SafeArrayGetUBound
VariantChangeType
SafeArrayPutElement
SafeArrayGetElement
VariantCopy
QueryPathOfRegTypeLi
VariantClear
SysReAllocStringLen
SafeArrayUnaccessData
comctl32
ImageList_GetDragImage
ord17
shlwapi
PathFileExistsW
StrRChrA
SHRegWriteUSValueW
PathRemoveArgsW
StrToIntW
StrCmpNW
PathCombineW
Sections
.text Size: 276KB - Virtual size: 275KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 44KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE