Static task
static1
Behavioral task
behavioral1
Sample
3d8dcd2fbd873d93cd803fa927e473b6_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3d8dcd2fbd873d93cd803fa927e473b6_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3d8dcd2fbd873d93cd803fa927e473b6_JaffaCakes118
-
Size
120KB
-
MD5
3d8dcd2fbd873d93cd803fa927e473b6
-
SHA1
5f229d1233f6b1cb2d0f2562cd67505614d7ed51
-
SHA256
6642f81df26b318d6baad7e033c28169a0bbdad43109459fd6829bd316a6b620
-
SHA512
689447f1acac4699b1836b1b7610970f5dc34524e6f9d52889eb700f5b3c2baff101390b3b4e76ac307e16027db9534dad9cca821511b9252f95874f23e51d7f
-
SSDEEP
3072:gdPRkmiLJWrv5x4p42PCFV2TX3mG4o0QG:gc9Ov4s2rl4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3d8dcd2fbd873d93cd803fa927e473b6_JaffaCakes118
Files
-
3d8dcd2fbd873d93cd803fa927e473b6_JaffaCakes118.exe windows:4 windows x86 arch:x86
7ab2131bfc7c29520417f8120e9c1c57
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SearchPathA
GetTempFileNameA
GetTempPathA
ReadFile
CreateFileA
DeviceIoControl
GetModuleHandleA
GetLocalTime
lstrlenA
MultiByteToWideChar
WideCharToMultiByte
LocalFree
SetEndOfFile
SetStdHandle
IsBadCodePtr
GetLastError
Sleep
GetModuleFileNameA
CreateDirectoryA
GetSystemDirectoryA
GetShortPathNameA
GetVolumeInformationA
GetPrivateProfileStringA
OpenMutexA
CreateToolhelp32Snapshot
Process32First
Process32Next
OpenProcess
GetFileAttributesA
DeleteFileA
CreateProcessA
WaitForSingleObject
CloseHandle
CopyFileA
SetFileAttributesA
LoadLibraryA
GetProcAddress
FreeLibrary
GetVersionExA
GetWindowsDirectoryA
IsBadReadPtr
GetStringTypeW
GetStringTypeA
FlushFileBuffers
SetFilePointer
IsBadWritePtr
VirtualAlloc
WriteFile
VirtualFree
HeapCreate
HeapDestroy
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
RtlUnwind
GetTimeZoneInformation
GetSystemTime
RaiseException
GetCommandLineA
GetVersion
ExitProcess
HeapFree
HeapAlloc
HeapReAlloc
TerminateProcess
GetCurrentProcess
LCMapStringA
LCMapStringW
GetCPInfo
CompareStringA
CompareStringW
HeapSize
GetACP
GetOEMCP
SetUnhandledExceptionFilter
SetEnvironmentVariableA
gdi32
GetTextCharsetInfo
advapi32
RegQueryValueExA
RegOpenKeyA
SetServiceStatus
RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA
ControlService
DeleteService
StartServiceA
QueryServiceStatus
CreateServiceA
ChangeServiceConfig2A
RegCreateKeyA
RegSetValueExA
OpenSCManagerA
OpenServiceA
CloseServiceHandle
DeregisterEventSource
GetUserNameA
CreateProcessAsUserA
RegQueryInfoKeyA
OpenProcessToken
RegOpenKeyExA
RegCloseKey
ole32
CoUninitialize
CoGetClassObject
CoInitialize
StringFromCLSID
oleaut32
VariantClear
wininet
InternetOpenA
InternetCrackUrlA
InternetGetConnectedState
DeleteUrlCacheEntry
InternetConnectA
HttpSendRequestA
HttpOpenRequestA
InternetReadFile
InternetCloseHandle
urlmon
URLDownloadToFileA
Sections
.text Size: 92KB - Virtual size: 91KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ