Static task
static1
Behavioral task
behavioral1
Sample
4084d1cc961be94e1be4d889c07fe41e_JaffaCakes118.exe
Resource
win7-20240705-en
General
-
Target
4084d1cc961be94e1be4d889c07fe41e_JaffaCakes118
-
Size
397KB
-
MD5
4084d1cc961be94e1be4d889c07fe41e
-
SHA1
0e439156e98c8006166b197c288f70e28a6b6c01
-
SHA256
1710067df4a584998504225a830b7354de5c2f627f63291731c6c18665f2da04
-
SHA512
bb560a6970cbb0e2bdaa807eb284b0b904681c2e0eaab06b9759dfa838fd3a580cb9b0a4d9966767aa23aaf2832eb801317f25870a450e2503d5288a12024564
-
SSDEEP
6144:YjIzZeDnC+Ey35/k98b5ScFE9zdn2DemnGggrsF2e6dJCxE9BL:YjIzQCupM98b5SOEFdpXsF0dJr
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4084d1cc961be94e1be4d889c07fe41e_JaffaCakes118
Files
-
4084d1cc961be94e1be4d889c07fe41e_JaffaCakes118.exe windows:5 windows x86 arch:x86
5d420be3dd0ea30e480b8ebd4ba66054
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
user32
OemToCharA
CharToOemA
advapi32
AdjustTokenPrivileges
GetSecurityDescriptorLength
OpenProcessToken
GetKernelObjectSecurity
LookupPrivilegeValueA
kernel32
RemoveDirectoryA
PeekNamedPipe
DeleteFileA
GetVolumeInformationA
GetVolumeInformationW
GetFileAttributesA
GetFileAttributesW
SetFileAttributesW
SetFileAttributesA
GetFullPathNameA
GetFullPathNameW
FileTimeToSystemTime
FileTimeToLocalFileTime
FindClose
FindFirstFileA
GetVersion
GetFileType
CloseHandle
GetFileTime
CreateFileA
CreateFileW
ReadFile
SetConsoleMode
GetConsoleMode
WideCharToMultiByte
MultiByteToWideChar
FindFirstFileW
FindNextFileW
FindNextFileA
GetLastError
HeapFree
HeapAlloc
GetProcessHeap
GetCurrentProcess
InitializeCriticalSection
ReleaseMutex
WaitForSingleObject
InterlockedExchange
CreateMutexA
lstrcpynA
GetDriveTypeA
lstrcmpiA
LeaveCriticalSection
EnterCriticalSection
lstrlenA
GetSystemTimeAsFileTime
GetModuleHandleW
Sleep
GetProcAddress
ExitProcess
CreateProcessA
DuplicateHandle
SetConsoleCtrlHandler
InterlockedIncrement
InterlockedDecrement
GetCPInfo
HeapReAlloc
GetDriveTypeW
MoveFileA
SetStdHandle
SetFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime
GetFileInformationByHandle
SetEnvironmentVariableW
SetFilePointer
GetCommandLineA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetTimeZoneInformation
HeapCreate
VirtualFree
DeleteCriticalSection
VirtualAlloc
WriteFile
GetConsoleCP
FlushFileBuffers
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
SetHandleCount
GetStdHandle
GetStartupInfoA
GetModuleFileNameA
LoadLibraryA
InitializeCriticalSectionAndSpinCount
CreatePipe
GetExitCodeProcess
GetModuleHandleA
RtlUnwind
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
LCMapStringW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
SetEndOfFile
GetCurrentDirectoryA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
HeapSize
GetLocaleInfoW
CompareStringA
CompareStringW
SetEnvironmentVariableA
Sections
.text Size: 230KB - Virtual size: 230KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 57KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 330KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 98KB - Virtual size: 98KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ