Static task
static1
Behavioral task
behavioral1
Sample
2eb1e040e189211cdd6fd07ff85b499f_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2eb1e040e189211cdd6fd07ff85b499f_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
2eb1e040e189211cdd6fd07ff85b499f_JaffaCakes118
-
Size
277KB
-
MD5
2eb1e040e189211cdd6fd07ff85b499f
-
SHA1
3c7f2a28c2e956d3802710730af5293d1a8d2872
-
SHA256
ab024af7741686a3729156e9402fb964e96938eb8e1a829c2afa842b9e1c6fde
-
SHA512
a23fb73d39d4d82001ea0b18db5cab7bdc7c16738c9ebcc26ca78a8fb2c91f8a5b9903c67214969e6452487f43d1c5fe93108aa9d7b6498b2fa9c2f717e49661
-
SSDEEP
6144:yV1VjlMindSC/xSAZ21ICSFjmf9fWDCxS2K0naW+tIqlnlkka:y1jlMiSGxBUVSFmf9fx2G4eu6r
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2eb1e040e189211cdd6fd07ff85b499f_JaffaCakes118
Files
-
2eb1e040e189211cdd6fd07ff85b499f_JaffaCakes118.exe windows:4 windows x86 arch:x86
330f2c5dace9c3041f0ad21343d6373a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetWindowsDirectoryA
lstrcpyA
ExpandEnvironmentStringsA
lstrcpyW
ExpandEnvironmentStringsW
GetCurrentThreadId
GetSystemInfo
GetModuleHandleW
GetTempPathA
GetTempFileNameA
SetErrorMode
OpenEventA
OpenMutexA
OpenSemaphoreA
CreateEventA
GetSystemDirectoryA
CreateSemaphoreA
SleepEx
QueryPerformanceFrequency
SetUnhandledExceptionFilter
CreateSemaphoreW
WaitForSingleObject
GetModuleHandleA
FreeLibrary
GetProcessHeap
CreateMutexA
IsDebuggerPresent
GetStartupInfoW
GetProcAddress
user32
GetSystemMetrics
wsprintfA
CharUpperA
CharLowerA
CharUpperW
CharLowerW
advapi32
DuplicateTokenEx
GetUserNameA
LookupAccountSidA
LookupPrivilegeValueA
AdjustTokenPrivileges
GetTokenInformation
EqualSid
InitializeAcl
AddAccessAllowedAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetSecurityDescriptorSacl
AllocateAndInitializeSid
GetLengthSid
FreeSid
CopySid
OpenThreadToken
ImpersonateLoggedOnUser
OpenProcessToken
DuplicateToken
SetThreadToken
RevertToSelf
shlwapi
PathUnExpandEnvStringsW
PathUnExpandEnvStringsA
rtutils
RouterLogRegisterW
RouterLogEventW
RouterLogDeregisterW
TraceVprintfExW
LogEventW
iyuv_32
DllMain
AboutDialogProc
Sections
.text Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.ui Size: 4KB - Virtual size: 539KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.TRYlp Size: 99KB - Virtual size: 120KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.DZ Size: 1KB - Virtual size: 97KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 2KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.qsdP Size: 1024B - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 7KB - Virtual size: 178KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.GRSLe Size: 115KB - Virtual size: 136KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.FmqEgM Size: 3KB - Virtual size: 184KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ