Static task
static1
Behavioral task
behavioral1
Sample
2b3d27e1532605b169a479ee9791a90d_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2b3d27e1532605b169a479ee9791a90d_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
2b3d27e1532605b169a479ee9791a90d_JaffaCakes118
-
Size
340KB
-
MD5
2b3d27e1532605b169a479ee9791a90d
-
SHA1
6849f8e4d92bcb59d60abba91f0062fd1539020f
-
SHA256
0bfbc25c2415a049726abe9bcef5f5185ca5ee1af693af994bd299d69bfeb99b
-
SHA512
31d9b567acd7e5d6ff365e410101830ff59edd36a346d1dd81bd25e070cc76151af490c495a295362cf4a1a0d828eb5ae5766645885420c99368e5335c37412a
-
SSDEEP
6144:50R0IFzKlRy3gnWdZprBCE1ye+2v1fdmcNy/IXdjuZS5vlZyx7qPw:5eFzKiJZpIENR1QcN0IXUU5vGx7+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2b3d27e1532605b169a479ee9791a90d_JaffaCakes118
Files
-
2b3d27e1532605b169a479ee9791a90d_JaffaCakes118.exe windows:4 windows x86 arch:x86
f56620fab591d42691e5fb2c293d20bf
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ExpandEnvironmentStringsW
GlobalFlags
GetThreadContext
GetTempFileNameA
TryEnterCriticalSection
LeaveCriticalSection
SetupComm
EnumResourceLanguagesW
DebugBreak
FileTimeToLocalFileTime
CreateMutexA
SetProcessAffinityMask
RemoveDirectoryA
VirtualQuery
GetBinaryTypeW
FreeEnvironmentStringsA
SetEndOfFile
SetTimeZoneInformation
IsBadReadPtr
PrepareTape
SetStdHandle
EnumResourceNamesW
WritePrivateProfileStructA
SetConsoleMode
IsBadWritePtr
WritePrivateProfileSectionA
SetCommTimeouts
VirtualAlloc
CreateDirectoryA
ReadConsoleOutputA
GetFileInformationByHandle
SetThreadPriorityBoost
FlushConsoleInputBuffer
VirtualLock
GetPrivateProfileStringA
VirtualAllocEx
SetFileTime
GetACP
GetUserDefaultLCID
GetProcessHeap
lstrcmpiW
FreeLibraryAndExitThread
_hread
FindFirstFileExW
GetDateFormatA
WritePrivateProfileStringW
WriteProcessMemory
GetCommandLineW
VirtualProtect
GetVersionExA
EnumResourceNamesA
LoadResource
SetConsoleWindowInfo
DosDateTimeToFileTime
GetProcessTimes
SearchPathW
WriteConsoleOutputCharacterA
ReadFile
EnumSystemCodePagesW
GetTapeParameters
GlobalUnlock
FindResourceExA
lstrcmpiA
GetVolumeInformationW
QueryDosDeviceW
CreateMutexW
GlobalFree
CloseHandle
OpenFile
SetErrorMode
SetMailslotInfo
GetTimeZoneInformation
GetSystemTimeAdjustment
EnumCalendarInfoW
PeekConsoleInputW
DuplicateHandle
WriteConsoleOutputW
IsDBCSLeadByteEx
IsProcessorFeaturePresent
CreateFileW
SetProcessShutdownParameters
GetCommandLineA
GetCurrentProcess
ExitProcess
user32
SetScrollRange
LoadMenuIndirectW
IsCharLowerW
gdi32
CreatePenIndirect
StartDocA
EqualRgn
GetTextCharsetInfo
LineTo
CreateHalftonePalette
ScaleViewportExtEx
GetWindowOrgEx
GetRegionData
CreateFontIndirectW
SetViewportExtEx
CreateCompatibleBitmap
GetBrushOrgEx
ExtTextOutA
CreateFontA
ArcTo
SetMapperFlags
GetTextExtentExPointW
GetFontData
DeleteMetaFile
GetTextExtentPointW
GetLayout
comdlg32
GetSaveFileNameA
ChooseFontA
advapi32
RegOpenKeyExA
GetSecurityDescriptorLength
RegLoadKeyA
AbortSystemShutdownW
SetFileSecurityW
CloseEventLog
AddAccessDeniedAce
ReadEventLogW
shell32
SHGetSpecialFolderLocation
ole32
CoGetClassObject
oleaut32
SafeArrayGetLBound
SysAllocStringLen
VariantChangeType
LoadTypeLibEx
SafeArrayUnaccessData
VariantCopy
LoadTypeLi
SafeArrayCreate
SafeArrayGetElement
comctl32
ImageList_Merge
shlwapi
PathIsRelativeA
setupapi
SetupGetIntField
SetupScanFileQueueA
SetupDiBuildClassInfoList
SetupDiDestroyDriverInfoList
Sections
.text Size: 304KB - Virtual size: 300KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 28KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE