Static task
static1
Behavioral task
behavioral1
Sample
36dd199a5f77cdbe784bb06ffca2ee7e_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
36dd199a5f77cdbe784bb06ffca2ee7e_JaffaCakes118
-
Size
97KB
-
MD5
36dd199a5f77cdbe784bb06ffca2ee7e
-
SHA1
3ebb6d9f387da935d87b176c292b6a6e5e4c7d47
-
SHA256
e2a2dc4c6a00f1343f2c2ca3ff2eff3820a9b450381780e43725af5d1e0b531f
-
SHA512
0914629210eb3a18e1a3754253e82c39dea48752723cc4d254319e57744d734132e1a173e353270008f9dfc36727251bc6b81807648f38f3237e0042adce32bc
-
SSDEEP
1536:3VNVK+AdfE2FMCtvalbYq+oOUDrrOzjVda:3XVK+C3FbAaqnrV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 36dd199a5f77cdbe784bb06ffca2ee7e_JaffaCakes118
Files
-
36dd199a5f77cdbe784bb06ffca2ee7e_JaffaCakes118.exe windows:4 windows x86 arch:x86
8128e4c3e398ab4c4083211b37c9157e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
GetLengthSid
OpenProcessToken
CryptGenRandom
AllocateAndInitializeSid
InitiateSystemShutdownA
InitializeSecurityDescriptor
InitializeAcl
SetSecurityDescriptorDacl
AddAccessAllowedAce
CryptAcquireContextA
CryptReleaseContext
GetTokenInformation
msvcrt
strchr
sprintf
kernel32
GetUserDefaultUILanguage
GetProcessHeap
GetDriveTypeA
GetSystemTimeAsFileTime
CreateThread
RemoveDirectoryA
CreateProcessA
ExpandEnvironmentStringsA
CreateEventA
GetModuleFileNameA
GetSystemTime
GetCurrentThreadId
FreeLibrary
SetEvent
LeaveCriticalSection
GetCurrentProcessId
HeapFree
DeleteCriticalSection
GetThreadPriority
MoveFileExA
WriteFile
GetFileAttributesA
GetCommandLineA
GetDiskFreeSpaceA
ExitProcess
LocalFileTimeToFileTime
SetErrorMode
CopyFileA
SetFileAttributesA
GetProcAddress
SetFileTime
CreateEventW
CreateDirectoryA
QueryDosDeviceA
CloseHandle
OpenEventA
QueryPerformanceCounter
DosDateTimeToFileTime
WaitForMultipleObjects
SystemTimeToFileTime
GetExitCodeProcess
GetFileSize
SetEndOfFile
GetSystemDirectoryA
DeviceIoControl
CreateFileA
SetFilePointer
DeleteFileA
TerminateProcess
FindNextFileA
SetUnhandledExceptionFilter
SleepEx
LoadLibraryA
GetModuleHandleA
GetVersionExA
WaitForSingleObject
EnterCriticalSection
GetTickCount
GetCurrentDirectoryA
HeapAlloc
GetCurrentProcess
SetLastError
ReadFile
FindClose
Sleep
FindFirstFileA
MoveFileA
WideCharToMultiByte
user32
ShowWindow
SendDlgItemMessageA
SetParent
SendMessageA
LoadStringA
DialogBoxParamA
EndDialog
MessageBoxA
shell32
SHGetPathFromIDListA
SHBrowseForFolderA
ntdll
NtOpenProcessToken
NtAdjustPrivilegesToken
NtShutdownSystem
NtClose
Sections
.text Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 5KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
.etext Size: 48KB - Virtual size: 75KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
qfrdbbl Size: - Virtual size: 60KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ftjqkdg Size: - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
gpadrzv Size: - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
fytdotn Size: - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
sxmufup Size: - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
hlozyer Size: - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
bgodowi Size: - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
vnrlcie Size: - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
xzohryx Size: 32KB - Virtual size: 128KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE