Static task
static1
Behavioral task
behavioral1
Sample
3564b466a9889b53bf488fcc3bb43d23_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3564b466a9889b53bf488fcc3bb43d23_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3564b466a9889b53bf488fcc3bb43d23_JaffaCakes118
-
Size
165KB
-
MD5
3564b466a9889b53bf488fcc3bb43d23
-
SHA1
265783b61ffe288350a6b873512071978f9de3d8
-
SHA256
afb9c028d7c01b1195ab250f9197dd9982e86ecb74dfbbf112e9a0764f8e410d
-
SHA512
974ddfc9eb2a9fcc6311229f76b8437399186a2c6776b3e18c3999268c386aaa5865b011d103f944e430382a726f30351981953c671752798e1fb77ef1c94c77
-
SSDEEP
768:0p1fczWDy6ALNCb7zr5epSAflTTVvAhV0eXSi/tQA4YVC3DCXHhJyQRupBkE9e:0p1u0b7v57ANTTpAhWuZ/74DCh/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3564b466a9889b53bf488fcc3bb43d23_JaffaCakes118
Files
-
3564b466a9889b53bf488fcc3bb43d23_JaffaCakes118.exe windows:1 windows x86 arch:x86
02e78485c3dc01de6dad635af736cecb
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleFileNameA
GetACP
GetLastError
SetFilePointer
ReadFile
ReadFile
MultiByteToWideChar
GetCurrentProcess
Sleep
InterlockedDecrement
GetStartupInfoA
CreateThread
GetCurrentProcessId
WaitForSingleObject
LocalFree
Sleep
InitializeCriticalSection
ReadFile
LoadLibraryW
GetTickCount
WaitForSingleObject
TerminateProcess
CreateThread
CloseHandle
GetVersionExA
GetStartupInfoA
GetSystemTimeAsFileTime
WideCharToMultiByte
HeapDestroy
CreateThread
EnterCriticalSection
GetCurrentProcessId
WaitForSingleObject
InitializeCriticalSection
HeapFree
GetCurrentProcess
WaitForSingleObject
GetLastError
ExitProcess
WaitForSingleObject
TerminateProcess
SetFilePointer
GetLastError
SetEvent
SetEvent
GetModuleHandleA
EnterCriticalSection
LeaveCriticalSection
GetStartupInfoA
SetFilePointer
CloseHandle
FormatMessageW
GetModuleHandleW
GetTickCount
GetStartupInfoA
lstrcpyW
MultiByteToWideChar
SetFilePointer
LocalFree
FreeLibrary
WriteFile
lstrcmpiW
HeapReAlloc
GetStartupInfoA
GetACP
GetLastError
WaitForSingleObject
HeapFree
GetCurrentProcessId
LoadLibraryA
LoadLibraryW
GetModuleHandleW
GetVersionExA
ReadFile
LocalAlloc
InitializeCriticalSection
InterlockedIncrement
EnterCriticalSection
SetLastError
LoadLibraryA
Sleep
GetCurrentProcess
VirtualAlloc
GetCommandLineA
CreateThread
LeaveCriticalSection
GetCurrentProcess
HeapReAlloc
Sleep
GetProcAddress
lstrcmpiW
SetUnhandledExceptionFilter
GetCurrentProcessId
GetCommandLineW
GetCurrentProcessId
HeapReAlloc
LoadLibraryA
GetProcessHeap
QueryPerformanceCounter
GetCommandLineW
lstrlenW
SetFilePointer
InterlockedDecrement
EnterCriticalSection
GetACP
GetLastError
InterlockedDecrement
lstrcpyW
CreateThread
CloseHandle
Sleep
LoadLibraryA
WriteFile
WaitForSingleObject
HeapAlloc
GetACP
HeapReAlloc
LocalFree
EnterCriticalSection
GetProcAddress
WaitForSingleObject
GetCurrentProcess
ReadFile
GetStartupInfoA
LoadLibraryA
HeapDestroy
InitializeCriticalSection
SetUnhandledExceptionFilter
GetProcAddress
GetCurrentThreadId
LeaveCriticalSection
HeapAlloc
GetVersionExA
GetACP
GetTickCount
LoadLibraryA
InitializeCriticalSection
GetACP
FreeLibrary
GetModuleHandleA
CreateThread
GetCurrentThreadId
lstrcpyW
LocalAlloc
ExitProcess
LocalFree
HeapDestroy
GetStartupInfoA
LocalAlloc
lstrlenW
GetModuleFileNameA
GetACP
SetFilePointer
GetStartupInfoA
LeaveCriticalSection
LocalFree
FreeLibrary
MultiByteToWideChar
GetCommandLineA
FormatMessageW
ExitProcess
MultiByteToWideChar
GetSystemTimeAsFileTime
WriteFile
Sleep
Sleep
lstrlenW
GetCommandLineW
HeapAlloc
InitializeCriticalSection
SetLastError
lstrcmpiW
EnterCriticalSection
lstrcmpiW
FreeLibrary
VirtualFree
GetLastError
GetVersionExA
GetProcessHeap
GetStartupInfoW
HeapReAlloc
GetACP
GetStartupInfoW
GetProcAddress
SetLastError
HeapFree
GetTickCount
GetSystemTimeAsFileTime
GetCurrentProcess
InterlockedIncrement
LeaveCriticalSection
GetCommandLineW
LeaveCriticalSection
InitializeCriticalSection
GetProcessHeap
FormatMessageW
WideCharToMultiByte
SetUnhandledExceptionFilter
GetCommandLineA
HeapDestroy
WriteFile
lstrcpyW
EnterCriticalSection
VirtualFree
MultiByteToWideChar
Sections
.text Size: 138KB - Virtual size: 152KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE