Static task
static1
Behavioral task
behavioral1
Sample
40017741d3c105899a8e2abe09d54432_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
40017741d3c105899a8e2abe09d54432_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
40017741d3c105899a8e2abe09d54432_JaffaCakes118
-
Size
200KB
-
MD5
40017741d3c105899a8e2abe09d54432
-
SHA1
a0c84cc348fbda968d8d72f233b3704e88e155ad
-
SHA256
4c8fb33eac911ec81b4b650d338d4654513b03d65f2b3427a0220ad57e926ee5
-
SHA512
bb0277abfff1e84b0f52ae3bc478c1299732873790251d88ca319db06216576a0cc53dbfeb2e4897e95c10b224ae7c36c0b49fdb8353259392cb202b8a1940f5
-
SSDEEP
3072:nxpWMUZV1QgkMkcW/ZeyTeLiD9of9lhraCt/6x:nD5W19qZeyTXqfpaE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 40017741d3c105899a8e2abe09d54432_JaffaCakes118
Files
-
40017741d3c105899a8e2abe09d54432_JaffaCakes118.exe windows:4 windows x86 arch:x86
293739e80682652565cd336efd4a9ed6
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
TerminateProcess
OpenProcess
GetCurrentProcess
GetProcAddress
GetModuleHandleA
GetTickCount
GetVersionExA
CreateToolhelp32Snapshot
CompareStringW
CompareStringA
FlushFileBuffers
GetLocaleInfoW
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
Process32First
Process32Next
OpenEventA
SetEvent
DeviceIoControl
DeleteFileA
CopyFileA
OutputDebugStringA
FindResourceA
LoadResource
SizeofResource
LockResource
CreateFileA
WriteFile
GetSystemDirectoryA
GetWindowsDirectoryA
MoveFileExA
CreateThread
CloseHandle
Sleep
CreateProcessA
lstrlenA
GetModuleFileNameA
SetStdHandle
GetTimeZoneInformation
InitializeCriticalSection
LoadLibraryA
InterlockedExchange
FreeLibrary
SetConsoleCtrlHandler
HeapSize
HeapReAlloc
VirtualAlloc
GetConsoleMode
RtlUnwind
GetCommandLineA
HeapFree
HeapAlloc
GetProcessHeap
GetStartupInfoA
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
GetLastError
GetCurrentThread
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
ExitProcess
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetStringTypeA
GetStringTypeW
LeaveCriticalSection
FatalAppExitA
EnterCriticalSection
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
SetFilePointer
GetConsoleCP
SetEnvironmentVariableA
user32
PostMessageA
CloseWindowStation
GetUserObjectInformationA
GetProcessWindowStation
CharUpperA
FindWindowA
advapi32
AdjustTokenPrivileges
CreateServiceA
ControlService
StartServiceA
DeleteService
QueryServiceStatus
CreateProcessAsUserA
OpenProcessToken
RegQueryValueExA
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerExA
GetUserNameA
QueryServiceConfigA
ChangeServiceConfigA
OpenSCManagerA
OpenServiceA
CloseServiceHandle
QueryServiceStatusEx
SetServiceStatus
RegOpenKeyExA
RegSetValueExA
RegCloseKey
LookupPrivilegeValueA
shlwapi
PathFileExistsA
wininet
InternetConnectA
HttpSendRequestA
InternetSetOptionA
HttpOpenRequestA
HttpQueryInfoA
InternetCloseHandle
InternetReadFile
InternetOpenA
Sections
.text Size: 148KB - Virtual size: 148KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1016B - Virtual size: 1016B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ