Static task
static1
Behavioral task
behavioral1
Sample
3e9a9fe670e902e0ee997df751627680_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3e9a9fe670e902e0ee997df751627680_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3e9a9fe670e902e0ee997df751627680_JaffaCakes118
-
Size
497KB
-
MD5
3e9a9fe670e902e0ee997df751627680
-
SHA1
11bab790cbefda0545f0b94334b9d0c3bd44f1ef
-
SHA256
cca680dd9e5d2386692353d785db9c95724bd0c6c946d104e5ffcbe116dab739
-
SHA512
54a96abda64de26cac23e4ccf279350cbe877552cdb7c8ccf1602b4d426eec9d1ad1bcdc6d4a339eea43b0c82589640da871ce9cbc4fa3edeea944b8c0405bf4
-
SSDEEP
12288:6cSZ/aggBc98+Q2R7twShQAQoZeRmWIFwGbQSU:6c4aggGq+Q+NFQeW1GbQSU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3e9a9fe670e902e0ee997df751627680_JaffaCakes118
Files
-
3e9a9fe670e902e0ee997df751627680_JaffaCakes118.exe windows:4 windows x86 arch:x86
c30f8a2e5ce163ee0f6e7569a6d1da5f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegSetKeySecurity
CryptEnumProviderTypesA
RegEnumKeyExA
RegEnumValueW
RegSetValueExW
RegSaveKeyA
CryptImportKey
RegOpenKeyA
RegLoadKeyW
RegDeleteKeyA
RegCreateKeyExW
RegSaveKeyW
RegDeleteKeyW
ReportEventW
RegQueryInfoKeyW
RegConnectRegistryA
CryptSignHashW
RegOpenKeyExW
DuplicateToken
RegQueryMultipleValuesA
gdi32
GetTextAlign
shell32
SHFormatDrive
FindExecutableA
DoEnvironmentSubstA
RealShellExecuteA
RealShellExecuteW
comdlg32
PageSetupDlgA
LoadAlterBitmap
GetSaveFileNameA
user32
MessageBoxIndirectW
RegisterClassA
TranslateAcceleratorW
TrackMouseEvent
ShowCursor
MenuItemFromPoint
GetDlgCtrlID
GetKeyboardLayoutNameW
ActivateKeyboardLayout
InsertMenuItemW
SetMessageQueue
UnregisterHotKey
RegisterClassExA
OpenDesktopA
LookupIconIdFromDirectory
CharLowerBuffW
SetDebugErrorLevel
SetClassWord
MessageBoxW
DefMDIChildProcA
DdeReconnect
ImpersonateDdeClientWindow
LoadCursorFromFileA
comctl32
InitCommonControlsEx
kernel32
SetFilePointer
SetHandleCount
CreateMutexA
QueryPerformanceCounter
InterlockedDecrement
EnterCriticalSection
GetACP
TlsSetValue
GetStringTypeA
ReadFile
GetSystemInfo
HeapAlloc
CompareStringW
InterlockedIncrement
WriteProfileStringW
InterlockedExchange
GetCurrentThread
GetVersion
OpenMutexA
GetCPInfo
HeapFree
WriteFile
GetStringTypeW
GetCurrentDirectoryA
SetConsoleOutputCP
GetStdHandle
TlsFree
TerminateThread
DeleteCriticalSection
GetProcAddress
TerminateProcess
GetStartupInfoA
GetSystemTime
GetCurrentProcessId
LCMapStringW
GetEnvironmentStringsW
IsBadWritePtr
GetLastError
LeaveCriticalSection
FlushFileBuffers
ExitProcess
HeapReAlloc
RtlUnwind
HeapDestroy
GetFileType
WriteConsoleInputA
VirtualFree
CloseHandle
InitializeCriticalSection
GetConsoleTitleW
VirtualQuery
SetThreadLocale
GetOEMCP
TlsAlloc
EnumSystemCodePagesA
GetEnvironmentStrings
MultiByteToWideChar
IsValidCodePage
CompareStringA
CreateNamedPipeW
LoadLibraryA
GetSystemTimeAsFileTime
FreeEnvironmentStringsA
SetEnvironmentVariableA
GetModuleHandleA
HeapCreate
LCMapStringA
SetStdHandle
WritePrivateProfileStructA
WideCharToMultiByte
TlsGetValue
SetLastError
GetModuleFileNameA
GetCommandLineA
GetLocalTime
GetTickCount
FormatMessageW
GetTimeZoneInformation
FileTimeToSystemTime
FreeEnvironmentStringsW
SetFileAttributesA
UnhandledExceptionFilter
GetCurrentProcess
VirtualAlloc
GetCurrentThreadId
Sections
.text Size: 124KB - Virtual size: 123KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 355KB - Virtual size: 355KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ