Static task
static1
Behavioral task
behavioral1
Sample
364e436bb9b062ffdb449db496b2cf67_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
364e436bb9b062ffdb449db496b2cf67_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
364e436bb9b062ffdb449db496b2cf67_JaffaCakes118
-
Size
53KB
-
MD5
364e436bb9b062ffdb449db496b2cf67
-
SHA1
43f9d48a9b564e5446fa730ff3494250db0fb682
-
SHA256
1c2382565eb188d4382199bfe3cadafdb415528f0edb6e14c38dd2b463a236c5
-
SHA512
7dec81349eb1057b9a28b3087cee6cf2778c3e50960d60e65dcf913b5ba60b1be535546dddcb5ee5c75d1964c5f77ab2fd4121199cdb9544da8af058c1da322d
-
SSDEEP
768:eOkqhuWiVO9x0DX+qOVkCEbblM8Q4kGFhcwcHWkQXgpZBynxPoYUqak:wvWiY/ksotkQAZBynxgY5ak
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 364e436bb9b062ffdb449db496b2cf67_JaffaCakes118
Files
-
364e436bb9b062ffdb449db496b2cf67_JaffaCakes118.exe windows:4 windows x86 arch:x86
29e4eda5d130dcb10c14e7a2ac98fa63
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
GetTokenInformation
GetUserNameA
InitializeSecurityDescriptor
LookupAccountSidA
OpenSCManagerA
QueryServiceStatus
RegOpenKeyExA
RegQueryInfoKeyA
UnlockServiceDatabase
kernel32
CloseHandle
CopyFileA
CreateDirectoryA
CreateEventA
CreateToolhelp32Snapshot
DeleteCriticalSection
DisableThreadLibraryCalls
EnterCriticalSection
ExitProcess
FindFirstFileA
FindResourceA
FlushFileBuffers
FormatMessageA
FreeEnvironmentStringsA
FreeLibrary
GetACP
GetCPInfo
GetConsoleOutputCP
GetCurrentProcess
GetCurrentThread
GetCurrentThreadId
GetExitCodeProcess
GetFileAttributesA
GetFileSize
GetLastError
GetLocalTime
GetLocaleInfoA
GetModuleFileNameA
GetProcAddress
GetProcessHeap
GetShortPathNameA
GetStartupInfoA
GetStdHandle
GetSystemTime
GetSystemTimeAsFileTime
GetTickCount
GetTimeFormatA
GetVersion
GetVersionExA
GetWindowsDirectoryA
GlobalFree
GlobalLock
GlobalUnlock
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSection
InterlockedExchange
IsBadCodePtr
IsValidCodePage
LeaveCriticalSection
LoadLibraryA
LoadLibraryExA
LoadResource
LocalAlloc
Module32First
MoveFileA
MultiByteToWideChar
QueryPerformanceCounter
RaiseException
ReadFile
ReadProcessMemory
RemoveDirectoryA
ResumeThread
SetEndOfFile
SetEnvironmentVariableA
SetErrorMode
SetEvent
SetFileAttributesA
SetFileTime
Sleep
SuspendThread
TerminateProcess
TlsFree
TlsGetValue
UnhandledExceptionFilter
VirtualAlloc
WritePrivateProfileStringA
lstrcmpiA
user32
CallNextHookEx
CharPrevA
CharUpperA
CheckDlgButton
CreateDialogParamA
DispatchMessageA
DrawTextA
FindWindowA
GetDC
GetMessageA
GetMessagePos
GetSysColorBrush
GetSystemMetrics
GetWindowDC
GetWindowRect
GetWindowTextA
LoadIconA
MessageBeep
MessageBoxA
MsgWaitForMultipleObjects
PostQuitMessage
PtInRect
SetFocus
SetTimer
SetWindowLongA
SetWindowRgn
TranslateMessage
UnregisterClassA
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
Sections
.text Size: 19KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.INIT Size: 12KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.edata Size: 15KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ