Static task
static1
Behavioral task
behavioral1
Sample
445118a2adb28236f88dc21e36fea8ad_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
445118a2adb28236f88dc21e36fea8ad_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
445118a2adb28236f88dc21e36fea8ad_JaffaCakes118
-
Size
204KB
-
MD5
445118a2adb28236f88dc21e36fea8ad
-
SHA1
143f194f4cba4eec421f5b4450ce3bfe977376a2
-
SHA256
f07fac110e6c5705a16050b377655311e131478677439a87f45925259e2ad4a3
-
SHA512
e43fd04725beee9347a16f136fc945558decd54e09803f598ed8958ee63a61c4f98291e0360f4abfdb348c47c15fdae9898c746734c4c79b5c1e875c484a06f9
-
SSDEEP
6144:lA843UBTDO4FsBHgQOM9qZQj8dewSZ7sX+:C843EDF6VmQQded
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 445118a2adb28236f88dc21e36fea8ad_JaffaCakes118
Files
-
445118a2adb28236f88dc21e36fea8ad_JaffaCakes118.exe windows:4 windows x86 arch:x86
5df84544719959439f37ff6e678db1d2
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
lz32
LZSeek
LZRead
LZOpenFileA
LZClose
kernel32
GetTempPathA
GetModuleFileNameA
ExpandEnvironmentStringsA
FindFirstFileA
RemoveDirectoryA
GlobalMemoryStatus
GetFileAttributesA
DeleteFileA
CreateDirectoryA
GetFileSize
SetFileAttributesA
GetShortPathNameA
ReadFile
CreateProcessA
CreateEventA
GetVersionExA
SetEvent
OpenEventA
WaitForSingleObject
MoveFileExA
GetDiskFreeSpaceA
GetProcAddress
LoadLibraryA
FreeLibrary
LocalFree
GetCurrentThread
CreateMutexA
OpenMutexA
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
FormatMessageA
GetSystemDirectoryA
InterlockedIncrement
InterlockedDecrement
GlobalFree
GlobalAlloc
GetModuleHandleA
GetTempFileNameA
FindClose
FindNextFileA
SearchPathA
GlobalUnlock
GlobalLock
CreateThread
lstrcmpiA
SetEnvironmentVariableA
CompareStringW
CompareStringA
ReleaseSemaphore
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
IsBadWritePtr
VirtualAlloc
SetEndOfFile
SetStdHandle
FlushFileBuffers
GetOEMCP
GetACP
GetCPInfo
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
HeapSize
HeapReAlloc
GetCurrentProcess
GetPrivateProfileStringA
CopyFileA
WriteFile
CreateFileA
SetFilePointer
GetTickCount
CloseHandle
WritePrivateProfileStringA
GetExitCodeProcess
GetLastError
SetLastError
Sleep
lstrcatA
GetWindowsDirectoryA
GetVolumeInformationA
lstrlenA
lstrcpynA
lstrcpyA
ResetEvent
GetLocalTime
OutputDebugStringA
GetCurrentThreadId
HeapAlloc
MapViewOfFile
CreateFileMappingA
TerminateProcess
LCMapStringW
LCMapStringA
MultiByteToWideChar
WideCharToMultiByte
TlsGetValue
TlsAlloc
TlsSetValue
GetCommandLineA
UnmapViewOfFile
HeapFree
GetFileType
ExitProcess
GetVersion
GetStartupInfoA
GetSystemTime
GetTimeZoneInformation
RtlUnwind
OpenSemaphoreA
user32
GetClassInfoExA
WaitForInputIdle
DestroyWindow
wsprintfA
DispatchMessageA
TranslateMessage
GetMessageA
UpdateWindow
SetWindowPos
ShowWindow
IsWindow
CreateWindowExA
SetRect
GetSystemMetrics
SystemParametersInfoA
RegisterClassExA
LoadCursorA
LoadIconA
DefWindowProcA
SetPropA
GetPropA
KillTimer
SetTimer
PostMessageA
EnumWindows
GetClassNameA
GetDesktopWindow
MessageBoxA
PostQuitMessage
SetForegroundWindow
PeekMessageA
GetCursorPos
GetWindowTextA
FindWindowA
IsWindowVisible
advapi32
RegOpenKeyExA
AreAllAccessesGranted
ImpersonateSelf
OpenThreadToken
AddAccessAllowedAce
GetAclInformation
GetAce
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
FreeSid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegEnumKeyExA
RegQueryInfoKeyA
RegEnumValueA
RegEnumKeyA
RegDeleteKeyA
RegDeleteValueA
RegCreateKeyExA
RegSetValueExA
AccessCheck
RegQueryValueExA
RegCloseKey
RevertToSelf
ole32
CoCreateGuid
version
GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA
wsock32
recv
WSACleanup
WSAStartup
WSACancelAsyncRequest
inet_addr
WSAAsyncGetHostByName
getsockopt
__WSAFDIsSet
select
connect
htons
ioctlsocket
bind
inet_ntoa
socket
closesocket
send
WSAGetLastError
Sections
.text Size: 148KB - Virtual size: 147KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 36KB - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 528B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ