Static task
static1
Behavioral task
behavioral1
Sample
2af5d58130f11a0c41595349ed166dc7_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2af5d58130f11a0c41595349ed166dc7_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
2af5d58130f11a0c41595349ed166dc7_JaffaCakes118
-
Size
113KB
-
MD5
2af5d58130f11a0c41595349ed166dc7
-
SHA1
5b395f3c06beea5edf74b4b09a8d350ecb7384e6
-
SHA256
d192e322b98ae05bd7a4f3c718a9a73ea971711ea1e16d6367353a88588f0671
-
SHA512
7569e7c3ef28cd07dde88bbbff109f7c26addadebe7510ecc2823a72793abeef74580daab217d9b85d20bca452ea38280e0fc480988bd93b357e4360e6e8e330
-
SSDEEP
3072:/joCMXP+f6FmxNTwNYFEB0M8tjWERGBxWuC:7oCc+f67NY6+M8tRGBxWuC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2af5d58130f11a0c41595349ed166dc7_JaffaCakes118
Files
-
2af5d58130f11a0c41595349ed166dc7_JaffaCakes118.exe windows:5 windows x86 arch:x86
56a5765e564362020bb00431eedaba29
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
SysFreeString
SysReAllocStringLen
SysAllocStringLen
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegOpenKeyW
RegCloseKey
RegSetValueExW
RegQueryValueExW
RegDeleteValueW
user32
GetKeyboardType
MessageBoxA
CharToOemBuffA
wvsprintfW
MessageBoxW
kernel32
GetACP
Sleep
VirtualFree
VirtualAlloc
GetSystemInfo
GetTickCount
QueryPerformanceCounter
GetVersion
GetCurrentThreadId
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
GetStartupInfoA
GetLastError
GetCommandLineW
FreeLibrary
ExitProcess
WriteFile
UnhandledExceptionFilter
SetFilePointer
SetEndOfFile
RtlUnwind
ReadFile
RaiseException
GetStdHandle
GetFileSize
GetFileType
CreateFileW
CloseHandle
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleW
WriteFile
WinExec
VirtualQuery
SwitchToThread
Sleep
SetFilePointer
SetEndOfFile
QueryPerformanceFrequency
QueryPerformanceCounter
LoadLibraryW
LeaveCriticalSection
InitializeCriticalSection
GetVersionExW
GetTickCount
GetProcAddress
GetLocalTime
GetLastError
GetFileTime
GetFileSize
FreeLibrary
FileTimeToSystemTime
FileTimeToLocalFileTime
ExpandEnvironmentStringsW
ExitProcess
EnterCriticalSection
DeleteCriticalSection
CreateProcessW
CreateFileW
CreateEventW
CloseHandle
LoadLibraryW
GetModuleFileNameW
GetFileAttributesW
GetCommandLineW
FindResourceW
CreateFileW
Sections
.text Size: 99KB - Virtual size: 99KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: 1024B - Virtual size: 640B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 11KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 8B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ