Static task
static1
Behavioral task
behavioral1
Sample
30ba69160ddc8d11ebd1cac907523da6_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
30ba69160ddc8d11ebd1cac907523da6_JaffaCakes118
-
Size
78KB
-
MD5
30ba69160ddc8d11ebd1cac907523da6
-
SHA1
7f4c459d446e75b9d879f9b4a3d8056b18463bb5
-
SHA256
8fea55582f186533bd760cc08a25404cd76f877f3c85d2b85fd1510b608b9f95
-
SHA512
63c999cd40cb5d903ef56932e290f947098ca1a502db07148e555f9481a53605351780c84d7f46d5a4185551fbc22ba8031e9778cb563baf4fcfbf62322277a6
-
SSDEEP
1536:CM5WouRc0Nshwhi3aBNg96jPW/FbD7kOe:yI0s3SNFeDS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 30ba69160ddc8d11ebd1cac907523da6_JaffaCakes118
Files
-
30ba69160ddc8d11ebd1cac907523da6_JaffaCakes118.exe windows:1 windows x86 arch:x86
a431a24380aec252e6a59013a4c15cb1
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WaitForSingleObject
ResetEvent
TlsFree
HeapSize
LCMapStringW
OpenProcess
VirtualFree
Module32Next
GetStartupInfoA
GetExitCodeThread
GetCPInfo
GetComputerNameW
WaitForMultipleObjects
CreateFileA
lstrcpyA
DeleteFileA
TlsAlloc
TlsGetValue
ExpandEnvironmentStringsA
CreateToolhelp32Snapshot
GlobalLock
GetCurrentProcess
RtlUnwind
HeapAlloc
GlobalMemoryStatus
DeleteCriticalSection
GlobalReAlloc
SetProcessWorkingSetSize
FindResourceA
GetFileType
SetThreadAffinityMask
MapViewOfFile
UnmapViewOfFile
FileTimeToLocalFileTime
UnhandledExceptionFilter
SetFilePointer
GetOEMCP
GetCurrentThreadId
GetModuleHandleW
WriteConsoleA
SetHandleCount
Sleep
LocalAlloc
SetUnhandledExceptionFilter
LoadResource
HeapReAlloc
SetEndOfFile
GetACP
OpenEventA
GetProcessAffinityMask
VirtualAlloc
CloseHandle
GetVersionExA
CreateEventA
InitializeCriticalSection
GetLocaleInfoA
GetFileAttributesA
ResumeThread
QueryPerformanceFrequency
MulDiv
ReadProcessMemory
TlsSetValue
GetModuleHandleA
GlobalUnlock
SearchPathA
CreateFileMappingA
VirtualQueryEx
GetLastError
GetConsoleMode
GetNumberFormatA
GlobalAlloc
InterlockedExchange
GetCommandLineW
FlushFileBuffers
FindFirstFileA
user32
GetClientRect
GetParent
wsprintfA
SetForegroundWindow
GetWindow
SetTimer
LoadIconA
CreatePopupMenu
SetFocus
PostMessageA
OffsetRect
GetScrollInfo
CheckDlgButton
ReleaseCapture
PtInRect
DefDlgProcA
PeekMessageA
GetFocus
GetCapture
GetWindowPlacement
DrawFrameControl
SetCapture
SendMessageTimeoutA
TranslateAcceleratorA
GetClassLongA
PostQuitMessage
IsZoomed
DrawIconEx
GetDlgCtrlID
GetUserObjectSecurity
SetClipboardData
GetWindowDC
GetCursorPos
UnionRect
BeginPaint
SetWindowTextA
EnumWindows
GetDC
FindWindowExA
InsertMenuA
DefMDIChildProcA
RegisterWindowMessageA
OpenClipboard
KillTimer
MsgWaitForMultipleObjects
InvalidateRect
IsDlgButtonChecked
SetDlgItemTextA
ScrollWindowEx
GetDesktopWindow
GetWindowRect
GetDlgItem
GetClassNameA
MoveWindow
DispatchMessageA
msvcrt
memmove
_exit
_XcptFilter
_vscwprintf
_adj_fdivr_m32
memset
_initterm
tan
_mbsnccnt
iswprint
_dstbias
_mbsspn
_lrotr
_aligned_offset_malloc
_controlfp
getwchar
_wrmdir
_ftime
_winver
_rmtmp
strncmp
_mbsnicoll
_ultoa
_ismbslead
_ui64tow
_mbsnbcat
_fdopen
strcspn
strftime
_fstati64
_acmdln
__p__fmode
_except_handler3
iswascii
_adjust_fdiv
_mbctombb
_tolower
_longjmpex
_wfdopen
_ismbcl1
_wchdir
wcstombs
iswalnum
strlen
_ismbcalnum
_close
memcpy
_stati64
_beep
__getmainargs
__setusermatherr
exit
__p__commode
mbtowc
cosh
_strncoll
_getdrives
_wsplitpath
_wrename
_wcsnset
wcscmp
__set_app_type
Sections
.text Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 58KB - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ