Static task
static1
Behavioral task
behavioral1
Sample
3c592548c9f6dc8a3f391fe8d49f3dd8_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3c592548c9f6dc8a3f391fe8d49f3dd8_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3c592548c9f6dc8a3f391fe8d49f3dd8_JaffaCakes118
-
Size
524KB
-
MD5
3c592548c9f6dc8a3f391fe8d49f3dd8
-
SHA1
cd69357c56007aa2dfd5a619124775d62473eaee
-
SHA256
f5b6b690550f1e2690a1b103cade68f9e6b78a2050d925cc12e232571d221639
-
SHA512
d1f35a0a3bf75ad8768730bdbe14750628bbc46335aa76a1612ede8dca4cb4f282e87ec22c499d053295cffc6c3afaf0080d94419b6a507be365a380795ba5b4
-
SSDEEP
3072:3QTPiOqiW9iEIf32ALXnGSeNxhSVAkxbjHB0/tHv9uy1xOwr5gSN9K7hT8lcY2oK:fS32ZNxQieb0hvX1xOwOW4bYOl
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3c592548c9f6dc8a3f391fe8d49f3dd8_JaffaCakes118
Files
-
3c592548c9f6dc8a3f391fe8d49f3dd8_JaffaCakes118.exe windows:4 windows x86 arch:x86
e6de035cab2692a047c4cd7dfa9302fc
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetWindowsDirectoryA
GetSystemDirectoryA
DeleteFileA
GetFileAttributesA
OpenProcess
SizeofResource
LockResource
FreeResource
LoadResource
FindResourceA
GetModuleHandleA
TerminateThread
WaitForSingleObject
CreateThread
FreeLibrary
GetProcAddress
LoadLibraryA
GetCurrentProcessId
GetVersionExA
CreateProcessA
VirtualFreeEx
ReadProcessMemory
WriteProcessMemory
VirtualAllocEx
GetModuleFileNameA
ExitProcess
GetPrivateProfileStringA
ReleaseMutex
CreateMutexA
OpenMutexA
CopyFileA
GetUserDefaultLCID
EnumSystemLocalesA
GetLocaleInfoA
IsValidCodePage
IsValidLocale
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetEndOfFile
IsBadCodePtr
IsBadReadPtr
GetStringTypeW
GetStringTypeA
SetStdHandle
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetCurrentThreadId
Sleep
CreateDirectoryA
CreateFileA
DeviceIoControl
CloseHandle
TerminateProcess
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentVariableA
SetUnhandledExceptionFilter
FlushFileBuffers
LCMapStringW
GetCurrentProcess
RtlUnwind
RaiseException
HeapFree
GetTimeZoneInformation
GetSystemTime
GetLocalTime
GetStartupInfoA
GetCommandLineA
GetVersion
GetLastError
WriteFile
ReadFile
SetFilePointer
SetHandleCount
GetStdHandle
GetFileType
HeapReAlloc
HeapAlloc
HeapSize
GetCPInfo
GetACP
GetOEMCP
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
GetLocaleInfoW
user32
GetClassNameA
GetWindowTextA
ShowWindow
GetWindowThreadProcessId
IsWindow
SetWindowPos
SetFocus
CreateDesktopA
SetThreadDesktop
CloseDesktop
GetThreadDesktop
PostMessageA
EnumChildWindows
GetWindowRect
SendMessageA
EnumDesktopWindows
EnumWindows
advapi32
RegSetValueExA
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
shell32
SHGetFileInfoA
netapi32
Netbios
wininet
InternetCloseHandle
InternetOpenUrlA
InternetOpenA
InternetReadFile
Sections
.text Size: 156KB - Virtual size: 154KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 320KB - Virtual size: 317KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ