Static task
static1
Behavioral task
behavioral1
Sample
3247512a600eac6b6e1e6fdf8d2eaa89_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3247512a600eac6b6e1e6fdf8d2eaa89_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3247512a600eac6b6e1e6fdf8d2eaa89_JaffaCakes118
-
Size
200KB
-
MD5
3247512a600eac6b6e1e6fdf8d2eaa89
-
SHA1
b58af3ceefb148ed71a6342c5e202cfa87d4d866
-
SHA256
69a15048ad611c3025c4bcc48e4114f74f46169e614fcf1651f942c604366902
-
SHA512
85ae2b401a1a77cefb8aa9f57ab16c3a14d9070b9bc837976da4f13bf0334ccda38dcab8c6a94994bb0005c6c84641e65902c9baacc2522910f2ce0a30cfa578
-
SSDEEP
3072:XFiVHuTk91psNlXapMsEN4Z+NiYZx85Uh4Lqvu:X8VHu491pxpiNu9YZdP2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3247512a600eac6b6e1e6fdf8d2eaa89_JaffaCakes118
Files
-
3247512a600eac6b6e1e6fdf8d2eaa89_JaffaCakes118.exe windows:1 windows x86 arch:x86
735092936bd7e4b9316161c08eac5236
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
_strset
_ultow
wcsxfrm
_utime64
_fullpath
_write
_heapadd
iswctype
_creat
ftell
_fstati64
_adj_fdiv_m32i
__set_app_type
fputwc
iscntrl
_controlfp
_longjmpex
_spawnlp
_getche
_ismbcdigit
memcmp
_ismbclower
longjmp
_cexit
_wutime64
_close
_wsearchenv
_adjust_fdiv
putwchar
strncmp
_getwch
_wspawnlp
_strdup
_ismbslead
asctime
_strncoll
_vscprintf
_mbbtombc
_safe_fdivr
_XcptFilter
_stat
_wtoi64
_mbbtype
_fputchar
wcscpy
_scwprintf
_wspawnvpe
_getdllprocaddr
memset
_futime
ctime
_ui64toa
__getmainargs
_mbctokata
_ismbbalpha
__setusermatherr
_commit
_cgetws
_mbsinc
_wremove
_cwscanf
srand
_mbctombb
__p__fmode
_beep
fputws
rand
_cabs
_exit
tmpnam
mktime
_heapset
_winminor
_initterm
_adj_fdiv_m16i
atan2
_ltoa
wprintf
_i64toa
_seh_longjmp_unwind
_ismbckata
_ungetwch
_cprintf
_acmdln
_lrotl
_fgetwchar
remove
_utime
_fcloseall
_mbcjistojms
__p__commode
_except_handler3
_getws
_tzname
isspace
memcpy
isdigit
system
_getcwd
_adj_fdiv_m64
_wexeclp
_execle
strpbrk
wcstod
_fmode
_unloaddll
wcsncmp
_isnan
_getmaxstdio
_stati64
_setjmp3
_mbsstr
exit
_wexecve
_cgets
_ismbcgraph
getc
_wasctime
_ismbbgraph
_ltow
isgraph
wcstoul
_statusfp
_heapchk
_memccpy
_rotr
_wexecle
setbuf
_atodbl
_strupr
fsetpos
kernel32
HeapAlloc
GetVersion
ResetEvent
PulseEvent
GetFileType
QueryPerformanceFrequency
DuplicateHandle
GetCurrentDirectoryA
GetDateFormatA
ExitProcess
MultiByteToWideChar
CreateEventA
TerminateThread
CreateThread
GetEnvironmentVariableA
GetProcessHeap
WriteFile
HeapFree
SetStdHandle
SizeofResource
lstrlenA
ResumeThread
GetSystemDirectoryA
GetCommandLineA
FindClose
LocalFree
IsBadReadPtr
SetUnhandledExceptionFilter
IsValidCodePage
lstrcpynA
GetStartupInfoA
GetProcAddress
LoadLibraryW
ReadProcessMemory
SetLastError
GetCurrentThread
CreateFileA
WaitForSingleObject
GlobalUnlock
OpenEventA
GetCurrentThreadId
GetEnvironmentStrings
LCMapStringA
SetPriorityClass
CreateProcessA
TlsAlloc
QueryPerformanceCounter
RtlUnwind
InitializeCriticalSection
SetEndOfFile
HeapCreate
GetSystemInfo
GetOEMCP
FreeEnvironmentStringsW
GetExitCodeThread
LocalAlloc
GetTickCount
GetProcessWorkingSetSize
ReadFile
GlobalReAlloc
GetLastError
GetModuleHandleW
FormatMessageA
GetConsoleCP
GetModuleHandleA
GetNumberFormatA
LoadLibraryA
LoadResource
UnhandledExceptionFilter
InterlockedIncrement
FindResourceA
FileTimeToSystemTime
SetEnvironmentVariableA
GlobalMemoryStatus
GetComputerNameW
GetConsoleOutputCP
GetStringTypeA
GetFileTime
TlsFree
SearchPathA
Sections
.text Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 187KB - Virtual size: 186KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 284B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ