Static task
static1
Behavioral task
behavioral1
Sample
3759e1e2dbb14415d8cf5dc8a765f5cb_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3759e1e2dbb14415d8cf5dc8a765f5cb_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3759e1e2dbb14415d8cf5dc8a765f5cb_JaffaCakes118
-
Size
425KB
-
MD5
3759e1e2dbb14415d8cf5dc8a765f5cb
-
SHA1
57ed477c958f24a419599f511878cf72eba40914
-
SHA256
324a1a3b07336872ebcf4a9eb2d38059f8da7160a59561ada22a4cd3045b7691
-
SHA512
3f35e4064c7bf531dde0c5415dfc349082e4643ba618fd708d0ca1a15ca02fb7a3923c1d65fe9d15ddbb14724d4f9335f4e61113aaee406fe00d64cdcbfb09f4
-
SSDEEP
12288:LZdaN4MMnMMMMMtcsB8okxvDa5CvGH2yVQQwrlO/8a28:LZdaKMMnMMMMMd/2a5MyVQQwrT8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3759e1e2dbb14415d8cf5dc8a765f5cb_JaffaCakes118
Files
-
3759e1e2dbb14415d8cf5dc8a765f5cb_JaffaCakes118.exe windows:4 windows x86 arch:x86
036145b35ac69acc9fb0621e1fe3466c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msi
MsiAdvertiseProductW
MsiConfigureFeatureW
MsiDatabaseCommit
kernel32
MulDiv
IsBadReadPtr
WideCharToMultiByte
GetVolumeInformationA
GetWindowsDirectoryA
DeleteFileA
GetACP
VirtualAlloc
FileTimeToSystemTime
GlobalHandle
CompareStringW
FreeEnvironmentStringsW
GetDateFormatA
FormatMessageA
IsBadCodePtr
LockFile
lstrcpynA
GetSystemTime
FreeLibrary
UnlockFile
GetCurrentThreadId
GetShortPathNameA
GetSystemInfo
CreateProcessA
FreeEnvironmentStringsA
FormatMessageW
UnhandledExceptionFilter
GetStringTypeW
GetFileTime
InterlockedDecrement
FindClose
IsDBCSLeadByte
TlsGetValue
GlobalSize
CreateFileA
GetEnvironmentStrings
GetCurrentProcessId
SetFileTime
TlsFree
lstrcatA
GetCPInfo
SetFilePointer
lstrcmpA
GetLastError
GetEnvironmentStringsW
GlobalReAlloc
GetFileAttributesA
_lread
GetExitCodeProcess
VirtualQuery
InterlockedIncrement
LoadLibraryExA
GetTimeZoneInformation
GetFullPathNameA
LCMapStringA
_lwrite
SetLastError
HeapFree
GlobalLock
FlushFileBuffers
CloseHandle
LockResource
TlsAlloc
GetModuleHandleA
CreateThread
SetErrorMode
ReadFile
SearchPathA
GlobalDeleteAtom
FlushInstructionCache
SetEvent
GetProfileStringA
RtlUnwind
GetVersion
GetStringTypeExA
ExitThread
GlobalFree
GetStdHandle
HeapReAlloc
ResumeThread
SetLocalTime
GlobalUnlock
CreateProcessW
Sleep
MultiByteToWideChar
LCMapStringW
GetTickCount
GetVersionExA
GetCurrentDirectoryA
lstrcpyA
GetOEMCP
GetLocalTime
GlobalAddAtomA
SetFileAttributesA
TlsSetValue
FileTimeToLocalFileTime
SetStdHandle
ExitProcess
WriteFile
FindNextFileA
HeapDestroy
lstrcmpiA
DuplicateHandle
SystemTimeToFileTime
GetStartupInfoA
SizeofResource
GetFileType
samlib
SamConnectWithCreds
SamRemoveMultipleMembersFromAlias
SamiEncryptPasswords
SamTestPrivateFunctionsUser
ddraw
DirectDrawEnumerateA
user32
CallMsgFilterA
Sections
.text Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.idata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 24KB - Virtual size: 872KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 64B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rdata Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 359KB - Virtual size: 358KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ