Static task
static1
Behavioral task
behavioral1
Sample
39d50f72375b7bb25d595179e5dd3f5a_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
39d50f72375b7bb25d595179e5dd3f5a_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
39d50f72375b7bb25d595179e5dd3f5a_JaffaCakes118
-
Size
436KB
-
MD5
39d50f72375b7bb25d595179e5dd3f5a
-
SHA1
7e02f6a8608329610547374464fad8bc3f68cdc3
-
SHA256
f2c9388f91cc3b0de5dfa2f3e6682b87f958050c66c1dc808b30a0f782d056d9
-
SHA512
e04f70c6e2c255a23eebc14e7a718104920ef29253ce423fe8dfa0f42f864fb72cb795ce2fb26201816947759131c1498024f9f4409dd6717b7faa98f9696439
-
SSDEEP
12288:pBfYxG4HSVV3BnKTCDdqs07t30JX9yu9FIQ:ffYxG4HYV3BKTC8sOSloKP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 39d50f72375b7bb25d595179e5dd3f5a_JaffaCakes118
Files
-
39d50f72375b7bb25d595179e5dd3f5a_JaffaCakes118.exe windows:5 windows x86 arch:x86
02c7b7650830062517152e8007b39216
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
psapi
GetModuleFileNameExA
kernel32
HeapAlloc
WriteFile
CreateFileA
lstrcpyA
Process32Next
Sleep
GetExitCodeProcess
TerminateProcess
OpenProcess
lstrcmpiA
Process32First
CreateProcessA
lstrlenA
CreateDirectoryA
SleepEx
GetModuleFileNameA
SetEndOfFile
SetFilePointer
ReadFile
GetFileSize
LoadLibraryExA
GetComputerNameA
LocalFree
GetVersionExA
GetLocalTime
lstrcatA
WaitForSingleObject
MoveFileExA
GetModuleHandleA
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
GetFileTime
GetCurrentProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
HeapCreate
LCMapStringW
LCMapStringA
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
FlushFileBuffers
GetTickCount
QueryPerformanceCounter
HeapFree
GetProcessHeap
SetLastError
DeleteFileA
GetFileAttributesA
OpenMutexA
CloseHandle
InterlockedDecrement
ExpandEnvironmentStringsA
GetLastError
OpenFileMappingA
CreateFileMappingA
MapViewOfFile
lstrcpynA
WideCharToMultiByte
FreeLibrary
LoadLibraryA
IsValidCodePage
GetProcAddress
GetFullPathNameA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetOEMCP
GetACP
GetCPInfo
HeapSize
GetCurrentThreadId
InterlockedIncrement
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetStdHandle
VirtualAlloc
DeleteCriticalSection
RtlUnwind
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapReAlloc
GetModuleHandleW
ExitProcess
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
GetFileType
GetConsoleCP
GetConsoleMode
GetCommandLineA
GetStartupInfoA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
VirtualFree
user32
FindWindowA
SendMessageTimeoutA
GetClassNameA
IsWindowVisible
EnumWindows
GetWindowThreadProcessId
IsWindow
advapi32
LookupAccountNameA
ConvertSidToStringSidA
RegSetValueExA
RegDeleteKeyA
RegQueryInfoKeyA
RegEnumKeyA
RegDeleteValueA
RegCreateKeyA
RegOpenKeyExA
RegQueryValueExA
RegOpenKeyA
RegCloseKey
OpenSCManagerA
OpenServiceA
QueryServiceStatus
CloseServiceHandle
shell32
ShellExecuteA
oleaut32
VariantClear
shlwapi
StrNCatA
StrStrIA
wnsprintfA
StrChrA
StrToIntA
SHDeleteKeyA
PathFileExistsA
Sections
.text Size: 131KB - Virtual size: 131KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 31KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 18KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 254KB - Virtual size: 254KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ