Static task
static1
Behavioral task
behavioral1
Sample
3f49d128d3e2f6f9e4b8aad005e50b03_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3f49d128d3e2f6f9e4b8aad005e50b03_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3f49d128d3e2f6f9e4b8aad005e50b03_JaffaCakes118
-
Size
676KB
-
MD5
3f49d128d3e2f6f9e4b8aad005e50b03
-
SHA1
a8dbe1ea36367b2e996e466cf90bff9f2e344e16
-
SHA256
d68fb6068a4040592cc6db7e59680975a8e3ec607271db544ac21bc79a74d03a
-
SHA512
72d286fc45a5782504dcabcd7e8d6027b671cbc35e3977d0d4ba1f149426974049539892e1230e3de5aea8f8851db8cc84345180da2d2701d0850a804c64d938
-
SSDEEP
12288:+g8GeOU40cKa54A4/l7OBWiQsaBUD2SCSlGoJMwfRr6vIBgXmqrxfPhct:f8fOU40cKa5i/lOWi/b2SCSgo3fRrqWN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3f49d128d3e2f6f9e4b8aad005e50b03_JaffaCakes118
Files
-
3f49d128d3e2f6f9e4b8aad005e50b03_JaffaCakes118.exe windows:5 windows x86 arch:x86
53eb41c8fd877e01703345e26c6d70f3
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegOpenKeyExA
RegSetValueExA
kernel32
WriteFile
HeapCreate
WideCharToMultiByte
CreateProcessA
GetModuleHandleW
GetACP
CloseHandle
ReadFile
GetModuleHandleA
TlsFree
MapViewOfFile
RaiseException
GetCurrentThread
InterlockedCompareExchange
Sleep
GetCurrentDirectoryA
GetCommandLineW
LockResource
GetCurrentProcessId
GetEnvironmentStrings
VirtualFree
lstrlenW
GlobalUnlock
GetEnvironmentStringsW
LCMapStringA
FindResourceW
GetConsoleCP
UnmapViewOfFile
LCMapStringW
GetLastError
InterlockedIncrement
HeapAlloc
CreateFileA
TlsSetValue
GetFileType
CreateEventA
GetTimeZoneInformation
GlobalLock
WaitForMultipleObjects
FindFirstFileW
CreateFileMappingA
CompareStringA
GetCurrentThreadId
CompareStringW
GetProcessHeap
GetProcAddress
DeleteFileA
GetStartupInfoA
LoadLibraryA
FlushFileBuffers
GetTickCount
QueryPerformanceCounter
SetEvent
lstrcmpiA
SetHandleCount
EnterCriticalSection
HeapFree
WriteConsoleW
LeaveCriticalSection
GetVersion
GetLocaleInfoA
SetEndOfFile
VirtualQuery
TerminateProcess
SetEnvironmentVariableA
SetUnhandledExceptionFilter
CreateThread
SetFilePointer
CreateMutexA
MultiByteToWideChar
LoadLibraryExW
UnhandledExceptionFilter
GetPrivateProfileStringA
GetModuleFileNameA
CreateProcessW
ExitProcess
IsDebuggerPresent
InterlockedDecrement
OutputDebugStringA
TlsGetValue
LoadResource
FormatMessageW
LocalFree
FreeLibrary
GetStringTypeW
HeapReAlloc
GetSystemTimeAsFileTime
InterlockedExchange
GetStringTypeA
LoadLibraryW
GetCPInfo
SetStdHandle
FreeEnvironmentStringsW
LocalAlloc
GetConsoleMode
GetCurrentProcess
DeleteCriticalSection
FreeEnvironmentStringsA
GetFileAttributesW
HeapDestroy
WaitForSingleObject
ReleaseMutex
GetConsoleOutputCP
GetStdHandle
GetCommandLineA
TlsAlloc
SetLastError
GetEnvironmentVariableA
RtlUnwind
InitializeCriticalSection
GetOEMCP
VirtualAlloc
FindResourceA
GetVersionExA
user32
InvalidateRect
SetDlgItemTextA
EndDialog
LoadCursorA
ClientToScreen
SetWindowTextA
SetWindowLongA
GetWindowRect
GetSystemMetrics
BeginPaint
SetFocus
FillRect
CreateWindowExA
GetWindowLongA
LoadStringA
IsWindowEnabled
TranslateMessage
EnableWindow
ShowWindow
UpdateWindow
GetParent
DestroyWindow
GetKeyState
GetClientRect
GetDC
PeekMessageA
EndPaint
PostQuitMessage
SetForegroundWindow
CallWindowProcA
GetFocus
SetCursor
SendMessageA
gdi32
SetBkColor
GetStockObject
CreateSolidBrush
Sections
.text Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 624KB - Virtual size: 624KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 27KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ