Static task
static1
Behavioral task
behavioral1
Sample
45ff15411adc73d69e3bf62e010a7a81_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
45ff15411adc73d69e3bf62e010a7a81_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
45ff15411adc73d69e3bf62e010a7a81_JaffaCakes118
-
Size
118KB
-
MD5
45ff15411adc73d69e3bf62e010a7a81
-
SHA1
efe3a01ad24771a7cc7e69a63c4984731c33e520
-
SHA256
cfcfbb23a34c77b75c089cf24098a1dd88bbc631d49b82300610c2326de3720c
-
SHA512
15fb5f6573b6a7acc506635faef0b302a5cea119528502c9cc491fb76ec45a30130d91a8bf80a97e9866e96c4dba8312a00100b36f81d91c64b37a6b355e343e
-
SSDEEP
1536:3f7KiXPWiL8oKMUFwlFaMVLsaQJrAOjiYlTbiA/WBDOIk0oIL7//6Qr3hWwCw:v7XPWto0wgaKTbiiUP6IP6G3V3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 45ff15411adc73d69e3bf62e010a7a81_JaffaCakes118
Files
-
45ff15411adc73d69e3bf62e010a7a81_JaffaCakes118.exe windows:5 windows x86 arch:x86
c61cab87eac820affd2f83a18f86858e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SizeofResource
FindResourceW
FindResourceExW
CloseHandle
CreateFileA
GetModuleFileNameA
ReadFile
lstrcmpiW
lstrcatW
lstrcpyW
GetVolumeInformationW
SetFilePointer
GetPrivateProfileSectionA
GetPrivateProfileIntA
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
FlushInstructionCache
GetCurrentProcess
SetLastError
GetFileAttributesA
CreateDirectoryA
WriteFile
Process32Next
Process32First
CreateToolhelp32Snapshot
LCMapStringW
HeapCreate
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
InterlockedDecrement
InterlockedIncrement
GetCPInfo
TerminateProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LockResource
GetModuleHandleW
GetProcAddress
Sleep
GetStartupInfoW
HeapSetInformation
LoadResource
RaiseException
WideCharToMultiByte
GetTempFileNameA
GetCommandLineA
DecodePointer
EncodePointer
FlushFileBuffers
CreateFileW
InterlockedPopEntrySList
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
MultiByteToWideChar
InterlockedPushEntrySList
InterlockedCompareExchange
GetProcessHeap
HeapSize
HeapReAlloc
WriteConsoleW
SetStdHandle
GetConsoleMode
GetConsoleCP
GetStringTypeW
RtlUnwind
LoadLibraryW
HeapFree
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameW
GetStdHandle
ExitProcess
GetTempPathA
GetLastError
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
HeapDestroy
HeapAlloc
user32
CallWindowProcA
GetClassInfoExA
PostMessageA
DestroyWindow
GetWindowLongA
SetWindowLongA
KillTimer
SetTimer
PostQuitMessage
LoadIconA
TranslateAcceleratorA
LoadAcceleratorsA
RegisterClassExA
LoadCursorA
DefWindowProcA
EndPaint
BeginPaint
CreateWindowExA
TranslateMessage
DispatchMessageA
GetMessageA
LoadStringA
UnregisterClassA
shell32
ShellExecuteA
SHGetSpecialFolderPathW
ole32
CoInitialize
CoCreateInstance
CoSetProxyBlanket
oleaut32
SysFreeString
SysAllocString
VariantInit
VariantClear
shlwapi
StrStrW
StrChrW
wvnsprintfW
StrCpyNW
wininet
InternetSetCookieA
ws2_32
select
WSAAsyncSelect
WSAAsyncGetHostByName
sendto
send
recvfrom
recv
connect
closesocket
socket
htons
htonl
WSASetLastError
WSAGetLastError
WSAStartup
bind
accept
Sections
.text Size: 72KB - Virtual size: 72KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 8KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.aspack Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE