Static task
static1
Behavioral task
behavioral1
Sample
30aa8d92a9812e0dcc4457c48911b906_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
30aa8d92a9812e0dcc4457c48911b906_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
30aa8d92a9812e0dcc4457c48911b906_JaffaCakes118
-
Size
315KB
-
MD5
30aa8d92a9812e0dcc4457c48911b906
-
SHA1
982cde85e6692e70ec2d023e8e9514db7272b7af
-
SHA256
3574d84d2179346dd65e12d301761e001cd5bb7127b33cfe7c2c50c4d84ec8ab
-
SHA512
3b9a34636dc54c9b3ebba74115c95fc5ae8337b74e828dacb3ca144707d2e4cc95afdea7294c8830bf3ffe943da597ad8b62e37940881644ae3177f6eb6c7b1f
-
SSDEEP
6144:4l3BRUUeQ2eR8QoCt8qKCCUh/3NXASrc81pAZ:5UerIPxyC59QS1Y
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 30aa8d92a9812e0dcc4457c48911b906_JaffaCakes118
Files
-
30aa8d92a9812e0dcc4457c48911b906_JaffaCakes118.exe windows:4 windows x86 arch:x86
7547d823bfa5adecc55b0009eb9c63c4
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetLocaleInfoA
GetCPInfo
SetLastError
FreeEnvironmentStringsW
RtlUnwind
InterlockedDecrement
FreeEnvironmentStringsA
GetCurrentProcess
GetUserDefaultLCID
VirtualAlloc
TlsAlloc
SetEnvironmentVariableA
HeapReAlloc
GetStringTypeA
CreateFileA
GetStdHandle
GetEnvironmentStringsW
Sleep
GetModuleFileNameA
GetLastError
InitializeCriticalSectionAndSpinCount
ExitProcess
GetModuleHandleW
HeapSize
IsValidCodePage
LoadLibraryA
GetTickCount
GetSystemTimeAsFileTime
HeapCreate
GetEnvironmentStrings
LCMapStringW
QueryPerformanceCounter
GlobalLock
UnhandledExceptionFilter
DeleteCriticalSection
TlsSetValue
GetCurrentThreadId
GetDateFormatA
HeapAlloc
GetTimeFormatA
HeapFree
GetEnvironmentVariableA
TlsFree
GetCurrentProcessId
EnumSystemLocalesA
InterlockedIncrement
HeapDestroy
WideCharToMultiByte
LCMapStringA
GetCurrentThread
GetOEMCP
IsDebuggerPresent
GetFileType
SetConsoleCtrlHandler
VirtualFree
TransactNamedPipe
FreeLibrary
GetModuleHandleA
lstrcmpW
GetLocaleInfoW
EnterCriticalSection
GetSystemDefaultLCID
TlsGetValue
CompareStringW
CompareStringA
GetCommandLineA
IsValidLocale
GetProcAddress
GetStartupInfoA
GetStringTypeW
GetACP
SetHandleCount
InterlockedExchange
LeaveCriticalSection
TerminateProcess
GetTimeZoneInformation
VirtualQuery
MultiByteToWideChar
WriteFile
SetCurrentDirectoryA
SetUnhandledExceptionFilter
user32
TranslateMessage
CharUpperBuffW
GetClassInfoExW
CreateDialogIndirectParamA
DdeReconnect
SystemParametersInfoA
GetMenuItemCount
DdeCreateStringHandleA
GetClipboardFormatNameW
GetWindowRect
EndDialog
ShowScrollBar
SwitchDesktop
BroadcastSystemMessageA
GetWindowThreadProcessId
CreateWindowExA
CharToOemW
EditWndProc
DdeSetQualityOfService
wsprintfA
ToUnicodeEx
wininet
InternetAttemptConnect
FtpRenameFileA
InternetLockRequestFile
InternetDialW
GetUrlCacheHeaderData
FtpRemoveDirectoryW
InternetShowSecurityInfoByURLW
InternetConnectW
SetUrlCacheEntryGroupA
FtpRenameFileW
InternetDialA
InternetShowSecurityInfoByURL
DeleteUrlCacheEntryW
GetUrlCacheConfigInfoW
FtpPutFileEx
GopherGetAttributeA
FindFirstUrlCacheGroup
FindNextUrlCacheContainerW
InternetTimeToSystemTimeW
Sections
.text Size: 128KB - Virtual size: 128KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 172KB - Virtual size: 171KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ