Static task
static1
Behavioral task
behavioral1
Sample
3a1c82eaaec9feaf8fcf5da4795cb52a_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3a1c82eaaec9feaf8fcf5da4795cb52a_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3a1c82eaaec9feaf8fcf5da4795cb52a_JaffaCakes118
-
Size
446KB
-
MD5
3a1c82eaaec9feaf8fcf5da4795cb52a
-
SHA1
6aececdd638acabddf6612deab9488f6c91f175d
-
SHA256
9ca8923134469430e55a2f0769aba3570ba83fec0f6031e5f0e6cbefea2f4bb4
-
SHA512
955a8b40bc092f1f0a9ab2fd14132cfb3aadc3b5a0efa2814d0bd8ad498306a6ca031b09079bf5618cfa2c4ced432397a9c750f9cb5fd2320b86da000d5f02ca
-
SSDEEP
12288:pniKcV+jd47OieUnv52KKOurEniWmeqi8hXSBEXZL+R:pniKcQjd47EM52KKOurCiW9qiMSBEX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3a1c82eaaec9feaf8fcf5da4795cb52a_JaffaCakes118
Files
-
3a1c82eaaec9feaf8fcf5da4795cb52a_JaffaCakes118.exe windows:4 windows x86 arch:x86
a51b1bc7d497f099a812d31497b7ef89
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
comdlg32
PageSetupDlgA
GetSaveFileNameW
FindTextA
GetFileTitleA
GetOpenFileNameA
ChooseColorW
PrintDlgW
GetSaveFileNameA
ReplaceTextA
GetFileTitleW
PageSetupDlgW
shell32
SHEmptyRecycleBinA
DoEnvironmentSubstW
SHGetPathFromIDListW
ShellHookProc
SHFileOperationW
RealShellExecuteExW
SHFormatDrive
DragQueryFileW
ShellExecuteEx
gdi32
DeviceCapabilitiesExA
ExtTextOutA
wininet
GetUrlCacheGroupAttributeW
HttpCheckDavCompliance
DeleteUrlCacheContainerW
InternetErrorDlg
InternetWriteFile
FtpOpenFileA
FtpRenameFileA
CreateUrlCacheGroup
GopherOpenFileA
IncrementUrlCacheHeaderData
InternetDialW
GetUrlCacheHeaderData
FindFirstUrlCacheGroup
FtpRenameFileW
InternetOpenUrlA
SetUrlCacheEntryGroupA
FindNextUrlCacheEntryA
SetUrlCacheEntryGroupW
InternetSetOptionW
SetUrlCacheEntryInfoW
FtpGetFileEx
InternetTimeFromSystemTime
SetUrlCacheGroupAttributeW
FtpGetFileSize
kernel32
VirtualQuery
ExitProcess
EnterCriticalSection
InterlockedExchange
SetSystemTime
GetCalendarInfoW
DeleteCriticalSection
GetCPInfo
CreateMutexW
LCMapStringW
QueryPerformanceCounter
TlsGetValue
GetFileType
SetConsoleCursorPosition
EnumSystemLocalesA
GetAtomNameA
FlushInstructionCache
IsValidCodePage
GetCurrentThread
UnhandledExceptionFilter
GetStringTypeW
GetTimeFormatA
InitializeCriticalSectionAndSpinCount
FreeLibrary
IsDebuggerPresent
HeapFree
HeapCreate
GetProfileSectionW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetOEMCP
GetCurrentProcessId
RtlUnwind
HeapAlloc
GetSystemTimeAsFileTime
lstrcpyW
GetSystemInfo
VirtualFree
GetLocaleInfoA
GetDateFormatA
SetEnvironmentVariableA
LeaveCriticalSection
GetStartupInfoA
SetUnhandledExceptionFilter
WideCharToMultiByte
GetTimeZoneInformation
GetLastError
WriteFile
WritePrivateProfileStructA
SetHandleCount
GetLocaleInfoW
GetModuleFileNameA
GetACP
Sleep
MultiByteToWideChar
GetCommandLineA
InterlockedDecrement
TlsSetValue
GetStdHandle
SetLastError
HeapSize
HeapReAlloc
InterlockedIncrement
SetConsoleCtrlHandler
GetStringTypeA
GetTickCount
GetEnvironmentStrings
HeapDestroy
VirtualAlloc
TerminateProcess
FileTimeToDosDateTime
LCMapStringA
GetModuleHandleA
GetUserDefaultLCID
HeapValidate
GetCurrentProcess
IsValidLocale
CompareStringA
GetCurrentThreadId
GetModuleHandleW
GetProcAddress
TlsAlloc
TlsFree
GetConsoleTitleW
LoadLibraryA
CompareStringW
FreeEnvironmentStringsA
advapi32
CryptSetProvParam
RegQueryValueExA
CryptDecrypt
RegRestoreKeyA
RegLoadKeyW
RegSetValueExA
RegReplaceKeyA
CryptHashData
CryptSetProviderA
Sections
.text Size: 155KB - Virtual size: 154KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 282KB - Virtual size: 304KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ