Static task
static1
Behavioral task
behavioral1
Sample
2dbbf4720cbb60a16dbed0f0d3b35005_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2dbbf4720cbb60a16dbed0f0d3b35005_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
2dbbf4720cbb60a16dbed0f0d3b35005_JaffaCakes118
-
Size
277KB
-
MD5
2dbbf4720cbb60a16dbed0f0d3b35005
-
SHA1
e316134e6c5b025634468c1cb43ea2832ea0cd46
-
SHA256
9cbc0862af515ad40a6e6614c6846991910bbe45a81ecff0189b41d020cfb5d1
-
SHA512
2ea68fdfca9296c866d0c8c13f0ea4d83af5dad199f772a9bccb3bdb796cf41eca43c00e418d5c5fcb81757027cdfd183bea1b03bc0e3939b195186d7ac14a75
-
SSDEEP
6144:AWseEiOB3eVSWpiG9wrXwv/jV1j0YhcNItJ/D1+rMwO:AIXW3eVSer8A51XmNiD1+rH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2dbbf4720cbb60a16dbed0f0d3b35005_JaffaCakes118
Files
-
2dbbf4720cbb60a16dbed0f0d3b35005_JaffaCakes118.exe windows:4 windows x86 arch:x86
b8f05a4f6d311f75f95dd539a7576114
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
AllocateAndInitializeSid
InitializeSecurityDescriptor
OpenSCManagerA
RegCloseKey
RegEnumKeyExA
RegEnumValueA
RegFlushKey
RegQueryValueA
SetServiceStatus
kernel32
AddAtomA
CreateDirectoryA
CreateThread
CreateToolhelp32Snapshot
DeleteCriticalSection
DeviceIoControl
DuplicateHandle
EnterCriticalSection
ExitProcess
ExitThread
ExpandEnvironmentStringsA
FindFirstFileA
FindResourceA
FlushFileBuffers
GetACP
GetConsoleMode
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDriveTypeA
GetFileAttributesA
GetFileSize
GetFileType
GetFullPathNameA
GetLastError
GetLocalTime
GetLocaleInfoA
GetModuleFileNameA
GetOEMCP
GetPrivateProfileSectionA
GetPrivateProfileSectionNamesA
GetStartupInfoA
GetStringTypeA
GetSystemDirectoryA
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetTempFileNameA
GetTempPathA
GetThreadTimes
GetTickCount
GetTimeZoneInformation
GetVersionExA
GlobalAlloc
GlobalReAlloc
HeapCreate
HeapReAlloc
HeapSize
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
IsBadWritePtr
IsValidCodePage
LeaveCriticalSection
LoadLibraryExA
LoadResource
LocalAlloc
LocalFree
LockResource
MoveFileA
OpenEventA
OutputDebugStringA
QueryPerformanceCounter
RaiseException
ReadFile
ReadProcessMemory
ReleaseMutex
RemoveDirectoryA
ResetEvent
SearchPathA
SetEndOfFile
SetFileAttributesA
SetThreadPriority
SuspendThread
TlsGetValue
UnhandledExceptionFilter
UnmapViewOfFile
WriteFile
lstrcpyA
lstrcpynA
lstrlenA
user32
CheckMenuItem
CreatePopupMenu
DefWindowProcA
DispatchMessageA
DrawTextA
EnableMenuItem
ExitWindowsEx
FillRect
GetAsyncKeyState
GetDlgItemTextA
GetProcessWindowStation
GetWindowRect
GetWindowTextLengthA
IsWindowVisible
LoadBitmapA
LoadIconA
MessageBeep
MessageBoxA
OffsetRect
PostMessageA
SetDlgItemInt
SetDlgItemTextA
SetForegroundWindow
SetTimer
SetWindowLongA
SystemParametersInfoA
wsprintfA
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
Sections
.text Size: 23KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.DATA Size: 230KB - Virtual size: 2.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.edata Size: 15KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ