Static task
static1
Behavioral task
behavioral1
Sample
38bc6c4b42e1bbb47e5ffda896332b31_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
38bc6c4b42e1bbb47e5ffda896332b31_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
38bc6c4b42e1bbb47e5ffda896332b31_JaffaCakes118
-
Size
216KB
-
MD5
38bc6c4b42e1bbb47e5ffda896332b31
-
SHA1
1ccf59a5abf9085fa19d5aa8cd2e2fec2b8564da
-
SHA256
1da9132a9d8640092ff57d55e30466ed0cb70ac29e6fedfb0ea370ce673554fe
-
SHA512
52f0ac9ef5e6872128ba339b28153b79acea36f06b730df0130db4fa866992241b9db1cfa5879d33d6d5a20b0e031c7735f43bc6aa94f7205b3c421116f13b37
-
SSDEEP
3072:Vsiz2V7AZmmyPJ6nrjp9BJvXXZogkDoA0sY4cTuWWnsETJeKQAuVLJY:VP2V7Azjp9jvXJoS33CWWsEib
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 38bc6c4b42e1bbb47e5ffda896332b31_JaffaCakes118
Files
-
38bc6c4b42e1bbb47e5ffda896332b31_JaffaCakes118.exe windows:4 windows x86 arch:x86
79ed1d63e1f8982b23328eea9bd4a097
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WaitForSingleObject
CreateProcessA
GetLocaleInfoA
WinExec
GetSystemDirectoryA
GetCurrentDirectoryA
GetCommandLineA
Sleep
CreateMutexA
ReleaseMutex
SetFileAttributesA
DeleteFileA
MoveFileA
GetFileSize
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
SetEndOfFile
GetSystemWindowsDirectoryA
CompareStringW
SetEnvironmentVariableA
SetFilePointer
WriteFile
lstrcmpA
GetWindowsDirectoryA
lstrcpynA
GetEnvironmentVariableA
GetFileAttributesA
CreateDirectoryA
GetPrivateProfileStringA
GetProcAddress
FreeLibrary
LoadLibraryA
GetCurrentThread
lstrcatA
GetCurrentProcess
GetLastError
lstrcmpiA
CreateFileA
ReadFile
CloseHandle
lstrlenA
lstrcpyA
MultiByteToWideChar
GlobalAlloc
GlobalLock
GlobalHandle
InterlockedExchange
CompareStringA
SetConsoleCtrlHandler
FlushFileBuffers
SetStdHandle
GetTimeZoneInformation
GetStringTypeW
GetStringTypeA
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
GlobalUnlock
GlobalFree
LocalFree
GetBinaryTypeA
GetModuleFileNameA
LocalAlloc
GetVersionExA
SetLastError
GetCurrentThreadId
GetSystemDefaultLCID
WideCharToMultiByte
lstrlenW
lstrcpyW
RtlUnwind
HeapAlloc
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeA
FindFirstFileA
GetModuleHandleA
GetStartupInfoA
GetVersion
ExitProcess
HeapFree
GetCPInfo
GetACP
GetOEMCP
TerminateProcess
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
IsBadWritePtr
GetFullPathNameA
SetCurrentDirectoryA
HeapSize
LCMapStringA
LCMapStringW
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
user32
LoadKeyboardLayoutA
RegisterWindowMessageA
SystemParametersInfoA
wsprintfA
EnumWindows
UnloadKeyboardLayout
CharNextA
PostThreadMessageA
GetDC
wvsprintfA
ReleaseDC
GetClassNameA
SendMessageTimeoutA
PostMessageA
gdi32
TextOutA
advapi32
RegUnLoadKeyA
GetSidIdentifierAuthority
RegEnumKeyA
RegOpenKeyA
RegCreateKeyA
GetUserNameA
OpenThreadToken
GetTokenInformation
OpenProcessToken
AdjustTokenPrivileges
InitializeSecurityDescriptor
RegSetKeySecurity
SetSecurityDescriptorOwner
SetSecurityDescriptorDacl
RegFlushKey
LookupPrivilegeValueA
RegDeleteValueA
RegDeleteKeyA
RegSetValueExA
RegCreateKeyExA
RegQueryInfoKeyA
RegEnumValueA
RegEnumKeyExA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
GetSidSubAuthorityCount
GetSidSubAuthority
FreeSid
IsValidSid
AllocateAndInitializeSid
GetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorA
shell32
SHGetMalloc
SHGetSpecialFolderLocation
SHGetPathFromIDListA
ole32
StringFromGUID2
CoInitialize
CoUninitialize
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
imm32
ImmInstallIMEA
Sections
_kelly_ Size: 136KB - Virtual size: 133KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 32KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ