Static task
static1
Behavioral task
behavioral1
Sample
3e03bc6c53464b2f818d9df6486d0c07_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3e03bc6c53464b2f818d9df6486d0c07_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3e03bc6c53464b2f818d9df6486d0c07_JaffaCakes118
-
Size
121KB
-
MD5
3e03bc6c53464b2f818d9df6486d0c07
-
SHA1
fefd4c684e40832762787b430a10a3a1489c71d0
-
SHA256
6229a3ff26152b6661743413fd418604f56d04ea88060418a00cd102072d96c7
-
SHA512
6d95fe058333a4e7f432ebd8b3f384a274c54571ab6285c84a15e1d74a65030f52ab4c4a30cdb4ece0531c08a6373606c030d78b48655572e75283ba6dc47504
-
SSDEEP
3072:xxCQJKE1fyKJR7SsFmiTIGSjf7DqAefJXRVLJY:SQUKvN0iTIHSAWJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3e03bc6c53464b2f818d9df6486d0c07_JaffaCakes118
Files
-
3e03bc6c53464b2f818d9df6486d0c07_JaffaCakes118.exe windows:5 windows x86 arch:x86
6c092cc3d3fa50ae9a31c119cf209cfe
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
wcschr
_beginthreadex
_wcsnicmp
?terminate@@YAXXZ
swprintf
wcsncat
swscanf
_wcsdup
wcscpy
memmove
_ftol
wcslen
_CxxThrowException
malloc
free
_purecall
_wcsicmp
??1type_info@@UAE@XZ
__dllonexit
_onexit
_controlfp
_except_handler3
wcscmp
_exit
_c_exit
__CxxFrameHandler
_XcptFilter
_cexit
exit
_wcmdln
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
iswspace
__set_app_type
wcscat
advapi32
RegSetValueExW
RegConnectRegistryW
RegOpenKeyExW
RegCloseKey
OpenThreadToken
RegisterEventSourceW
DeregisterEventSource
SetThreadToken
kernel32
GetTickCount
GlobalUnlock
GlobalLock
GlobalSize
GetCommandLineW
GetFileAttributesExW
GetLastError
GetUserDefaultLCID
GetTimeZoneInformation
CreateDirectoryW
GetTempPathW
WaitForMultipleObjects
GetCurrentThread
SetEnvironmentVariableW
GetEnvironmentVariableW
MultiByteToWideChar
WideCharToMultiByte
WriteFile
SetFilePointer
CreateFileW
lstrlenA
MoveFileExW
ReadFile
GetFileInformationByHandle
DuplicateHandle
GetCurrentProcess
SetFileAttributesW
DeleteFileW
GetModuleHandleA
GetStartupInfoW
RaiseException
LoadLibraryA
LocalAlloc
GetSystemTime
InterlockedExchange
CreateEventW
GetCurrentThreadId
Sleep
CreateThread
ReleaseMutex
ResetEvent
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
SetLastError
lstrcmpiA
InitializeCriticalSection
DeleteCriticalSection
HeapDestroy
InterlockedIncrement
InterlockedDecrement
LeaveCriticalSection
EnterCriticalSection
lstrlenW
CloseHandle
lstrcpyW
lstrcatW
GetModuleFileNameW
LoadLibraryW
FreeLibrary
WaitForSingleObject
SetEvent
GetProcAddress
user32
LoadStringW
PostThreadMessageW
CharNextW
DispatchMessageW
GetMessageW
MsgWaitForMultipleObjects
TranslateMessage
PeekMessageW
ole32
CoGetCallContext
CLSIDFromString
CoTaskMemAlloc
CoCreateInstance
CoSuspendClassObjects
CoRevokeClassObject
CoInitializeEx
CoInitializeSecurity
CoUninitialize
CoRegisterClassObject
oleaut32
SysAllocStringLen
SysFreeString
LoadRegTypeLi
SysStringLen
VariantInit
VariantTimeToSystemTime
VariantChangeTypeEx
SafeArrayCreateVector
SafeArrayAccessData
VariantChangeType
VariantCopy
VariantClear
SysAllocString
LoadTypeLi
RegisterTypeLi
SystemTimeToVariantTime
SafeArrayUnaccessData
ntdll
_ltow
Sections
_kelly_ Size: 88KB - Virtual size: 87KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.text Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ