Static task
static1
Behavioral task
behavioral1
Sample
30deed83f316b0ebb10128412f5ca3e1_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
30deed83f316b0ebb10128412f5ca3e1_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
30deed83f316b0ebb10128412f5ca3e1_JaffaCakes118
-
Size
172KB
-
MD5
30deed83f316b0ebb10128412f5ca3e1
-
SHA1
3c6b991dbad992cc20c1721aeac3ace09dc2c242
-
SHA256
a86cba1f0fa184befeb10100dbe46a16a7f4367acaa703462457876581457684
-
SHA512
b1f8a1e6f5f5919a03d6c5fa22f2640b139180f89ab904e3fffd4fe81dd39cddc6a28bdb8fb8fefcd51ef5203dc4231b52b5b80f57f77f41cc330331ff3cf5b8
-
SSDEEP
3072:cSLo4VbphFlRirLzm1MDQ5DzR3PnGRpNajViaSQpTpg:cso4V3lREm1PnGRfjajlg
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 30deed83f316b0ebb10128412f5ca3e1_JaffaCakes118
Files
-
30deed83f316b0ebb10128412f5ca3e1_JaffaCakes118.exe windows:5 windows x86 arch:x86
93863926490a0540f534e7bde8a967b1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetSystemDirectoryA
FreeLibrary
LoadLibraryA
CreateDirectoryA
GetPrivateProfileStructA
GetPrivateProfileIntA
WinExec
CreateToolhelp32Snapshot
Process32First
CloseHandle
OpenProcess
TerminateProcess
Process32Next
FindFirstFileA
FindNextFileA
FindClose
GetModuleHandleA
GetProcAddress
GetSystemInfo
lstrcmpiA
GetWindowsDirectoryA
LocalAlloc
lstrlenA
GetFileAttributesA
SetFileAttributesA
DeleteFileA
CopyFileA
GetModuleFileNameA
GetVersionExA
GetLastError
FormatMessageA
LocalFree
SetLastError
GetPrivateProfileStringA
GetLocalTime
HeapSize
ReadFile
GetProcessHeap
SetEndOfFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
FlushFileBuffers
SetStdHandle
CreateFileA
GetConsoleMode
HeapFree
HeapAlloc
GetCommandLineA
EnterCriticalSection
LeaveCriticalSection
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThreadId
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
Sleep
ExitProcess
WriteFile
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
SetFilePointer
GetConsoleCP
advapi32
QueryServiceLockStatusA
UnlockServiceDatabase
ControlService
ChangeServiceConfigA
QueryServiceConfigA
DeleteService
RegDeleteKeyA
RegDeleteValueA
RegQueryValueExA
RegOpenKeyExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
OpenSCManagerA
OpenServiceA
CloseServiceHandle
CreateServiceA
LockServiceDatabase
setupapi
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInstanceIdA
SetupDiGetDeviceRegistryPropertyA
SetupInstallFromInfSectionA
CM_Request_Device_EjectA
SetupCopyOEMInfA
SetupOpenInfFileA
SetupFindFirstLineA
SetupCloseInfFile
SetupGetStringFieldA
SetupFindNextLine
SetupDiSetClassInstallParamsA
SetupDiCallClassInstaller
CM_Locate_DevNode_ExA
CM_Reenumerate_DevNode_Ex
SetupDiGetClassDevsA
SetupDiEnumDeviceInfo
SetupDiSetDeviceRegistryPropertyA
newdev
UpdateDriverForPlugAndPlayDevicesA
shlwapi
PathRemoveFileSpecA
Sections
.text Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 4KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 71KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE