Static task
static1
Behavioral task
behavioral1
Sample
2c045bf973e2f0e73c49dd280eabe31d_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2c045bf973e2f0e73c49dd280eabe31d_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
2c045bf973e2f0e73c49dd280eabe31d_JaffaCakes118
-
Size
192KB
-
MD5
2c045bf973e2f0e73c49dd280eabe31d
-
SHA1
bbd0a9e77ad325accb8e3317f600e81b9d14b658
-
SHA256
d9fddd81830a9098a0f768bfaf22cec05bf67e52436cc3fac7cdc8831ea43708
-
SHA512
daa7db95ca03ee744ec7021407900c0f119b189eed197c37b2f50d48588f2d66cbc07267a0747833145115871a8b4fd9038a6fc6a867cf494e959fd8fcf2b787
-
SSDEEP
3072:PDRhB6WnVZeW9cmVg7UDzqOc51s6wlEhTHCpSwoVp54R4xEC4w+FZ/2Fy:16WnVZeSgwTmNHCwwU4emChK+F
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2c045bf973e2f0e73c49dd280eabe31d_JaffaCakes118
Files
-
2c045bf973e2f0e73c49dd280eabe31d_JaffaCakes118.exe windows:4 windows x86 arch:x86
4511570cc98ee90cc1d5acb0c393b8cd
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
SetFileSecurityA
GetSecurityDescriptorControl
SetSecurityDescriptorDacl
AddAccessAllowedAce
AddAce
EqualSid
GetAce
InitializeAcl
GetLengthSid
GetAclInformation
GetSecurityDescriptorDacl
InitializeSecurityDescriptor
LookupAccountNameA
GetFileSecurityA
RegCloseKey
RegOpenKeyExA
RegEnumValueA
RegEnumKeyExA
RegQueryValueExA
RegDeleteValueA
RegDeleteKeyA
RegSetValueExA
RegCreateKeyExA
ChangeServiceConfig2A
CloseServiceHandle
DeleteService
CreateServiceA
OpenSCManagerA
ControlService
StartServiceA
GetServiceKeyNameA
GetUserNameA
kernel32
HeapFree
Sleep
GetProcAddress
GetModuleHandleA
HeapAlloc
GetProcessHeap
GetLastError
lstrcatA
ExitProcess
CreateDirectoryA
SetEnvironmentVariableA
lstrlenA
lstrcpyA
GetWindowsDirectoryA
GetTempPathA
GetCurrentDirectoryA
MoveFileA
CloseHandle
SetFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime
WriteFile
CreateFileA
GetTickCount
GetModuleFileNameA
WaitForSingleObject
CreateEventA
GetFileAttributesA
GetShortPathNameA
ExpandEnvironmentStringsA
GetSystemDirectoryA
OpenEventA
SetUnhandledExceptionFilter
GetCommandLineA
WideCharToMultiByte
MultiByteToWideChar
DeleteFileA
SetFileAttributesA
Process32Next
GetCurrentProcessId
Process32First
CreateToolhelp32Snapshot
LoadLibraryA
RaiseException
InterlockedExchange
LocalAlloc
FreeLibrary
GetStartupInfoA
msvcrt
strlen
??2@YAPAXI@Z
memcpy
??3@YAXPAX@Z
strcmp
__CxxFrameHandler
_CxxThrowException
strncpy
strstr
free
malloc
rand
srand
_ftol
toupper
tolower
??1type_info@@UAE@XZ
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
_strupr
_stricmp
_strlwr
strcpy
strchr
strncat
strcat
_except_handler3
memset
wcstombs
_strnicmp
_strrev
_itoa
user32
wsprintfA
CharNextA
Sections
.text Size: 16KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 164KB - Virtual size: 163KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ