Static task
static1
Behavioral task
behavioral1
Sample
3c9cb99bdc0b3fe24501702576087e12_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3c9cb99bdc0b3fe24501702576087e12_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3c9cb99bdc0b3fe24501702576087e12_JaffaCakes118
-
Size
159KB
-
MD5
3c9cb99bdc0b3fe24501702576087e12
-
SHA1
e2d85ead0044cc48e5ac4e8f39800524196d58d0
-
SHA256
ad01d1d89a3d19fdae58bc30afcf4fbf3c124131d385abd4bca4fbaa01521470
-
SHA512
14e300d08bbd222e74271e84e049a69ed8d71ce2cd11dd3e836a42b07d98fca7f812137cb9add9a5b404457559cd2406cb4f16f95fd2cd48fcd21386b3f84008
-
SSDEEP
3072:A1XmnVKXi9DvPSX0rJ4OpbQp1Fj8Zk3n7Qeokrcj0fy:V9DvPSX0VtpRZic
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3c9cb99bdc0b3fe24501702576087e12_JaffaCakes118
Files
-
3c9cb99bdc0b3fe24501702576087e12_JaffaCakes118.exe windows:4 windows x86 arch:x86
e86f7bb5b725eed7ae668c6eef440fec
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
ChangeServiceConfig2A
ControlService
DeleteService
FreeSid
GetSecurityDescriptorControl
GetUserNameA
InitializeSecurityDescriptor
LookupAccountSidA
RegDeleteKeyA
RegSetValueExA
kernel32
CreateDirectoryA
CreateEventA
CreateFileMappingA
CreateThread
CreateToolhelp32Snapshot
DeleteCriticalSection
DisableThreadLibraryCalls
EnterCriticalSection
ExitProcess
ExpandEnvironmentStringsA
FileTimeToLocalFileTime
FindClose
FindResourceA
FlushFileBuffers
FreeLibrary
GetCommandLineA
GetConsoleCP
GetConsoleMode
GetCurrentDirectoryA
GetCurrentProcess
GetCurrentProcessId
GetDateFormatA
GetDriveTypeA
GetExitCodeProcess
GetFullPathNameA
GetLastError
GetLocalTime
GetModuleHandleA
GetOEMCP
GetPrivateProfileSectionA
GetPrivateProfileSectionNamesA
GetPrivateProfileStringA
GetPrivateProfileStructA
GetProcAddress
GetProcessHeap
GetSystemDirectoryA
GetSystemTime
GetTempFileNameA
GetTickCount
GetTimeZoneInformation
GetVersionExA
GlobalAlloc
GlobalHandle
GlobalUnlock
HeapCreate
HeapSize
InitializeCriticalSection
InterlockedCompareExchange
InterlockedDecrement
IsBadWritePtr
LCMapStringA
LeaveCriticalSection
LoadResource
LocalAlloc
LocalFree
LockResource
Module32First
MoveFileExA
OpenProcess
OutputDebugStringA
QueryPerformanceCounter
RaiseException
ReadFile
SearchPathA
SetEndOfFile
SetFilePointer
SetFileTime
SetHandleCount
SetPriorityClass
Sleep
SuspendThread
TlsFree
TlsGetValue
TlsSetValue
VirtualFree
WaitForSingleObject
WriteConsoleA
lstrcmpA
lstrcpyA
user32
CreatePopupMenu
DialogBoxParamA
DispatchMessageA
DrawIcon
ExitWindowsEx
FillRect
FindWindowA
GetAsyncKeyState
GetCapture
GetDC
GetDesktopWindow
GetForegroundWindow
GetProcessWindowStation
GetSysColorBrush
GetWindowPlacement
GetWindowTextLengthA
LoadCursorA
MapWindowPoints
MessageBoxA
MoveWindow
PeekMessageA
PostMessageA
RegisterClassA
SetDlgItemTextA
SetFocus
SetTimer
ShowWindow
UnregisterClassA
wsprintfA
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
Sections
.text Size: 24KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.DATA Size: 111KB - Virtual size: 236KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.edata Size: 15KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ