Static task
static1
Behavioral task
behavioral1
Sample
465585b055184816fd4ce9b7b7a9ba2f_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
465585b055184816fd4ce9b7b7a9ba2f_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
465585b055184816fd4ce9b7b7a9ba2f_JaffaCakes118
-
Size
462KB
-
MD5
465585b055184816fd4ce9b7b7a9ba2f
-
SHA1
0e159cf1f989bf3cc3eb9ae309a2ddd773f353f0
-
SHA256
504a901b25438428adb48bf5584cfe506524769cfffd3af37c7eceb0daaef94d
-
SHA512
e7da91952bc13b93e7388da43e2dd99aa369409851f74f31ed5d39547ca12fc3ec3d0679175ef94683e3d0c121ef63cb297f9ee19051d2ab13c2648d0564066e
-
SSDEEP
6144:/ZHjHGcd2H4SBNV28a1bsiIFCeZjtUPJwakGOHaMieB6BzLVfb2cNGf6ojzJ:B6bNu1bsZQebUCakz9412I8zJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 465585b055184816fd4ce9b7b7a9ba2f_JaffaCakes118
Files
-
465585b055184816fd4ce9b7b7a9ba2f_JaffaCakes118.exe windows:5 windows x86 arch:x86
0e1c16c4e37c604f760c92399c2e92f3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegCreateKeyExA
RegQueryValueExA
RegSetValueExA
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExA
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegSetKeySecurity
SetNamedSecurityInfoW
GetSecurityDescriptorDacl
RegDeleteValueW
RegOpenKeyW
GetTraceEnableLevel
GetTraceEnableFlags
GetTraceLoggerHandle
RegisterTraceGuidsW
RegCloseKey
kernel32
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
VirtualAlloc
VirtualProtect
VirtualFree
HeapAlloc
GetModuleHandleW
MultiByteToWideChar
GetModuleFileNameA
GetVersionExA
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetProcessHeap
HeapFree
InterlockedDecrement
InterlockedIncrement
GetLastError
UnhandledExceptionFilter
CreateFileA
CloseHandle
GetModuleHandleA
GetSystemTimeAsFileTime
GetProcAddress
CreateFileMappingA
MapViewOfFile
SetLastError
InterlockedExchange
LoadLibraryA
DeviceIoControl
FreeEnvironmentStringsA
FreeEnvironmentStringsW
lstrlenA
lstrlenW
GetEnvironmentStrings
GetEnvironmentStringsW
GetDiskFreeSpaceA
GlobalMemoryStatus
GetLocalTime
GetSystemInfo
WaitForSingleObject
ResumeThread
SetThreadPriority
SetThreadAffinityMask
CreateThread
GetProcessAffinityMask
ReadFile
WriteFile
FreeLibrary
WideCharToMultiByte
CreateFileW
LocalFree
GetFileAttributesW
LoadLibraryW
SetFileAttributesW
FindClose
RemoveDirectoryW
FindNextFileW
DeleteFileW
FindFirstFileW
CreateDirectoryW
GetWindowsDirectoryW
Sleep
InterlockedCompareExchange
GetFileSize
OutputDebugStringA
UnmapViewOfFile
LocalAlloc
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
ExitProcess
GetSystemTime
SetEvent
CreateEventA
TlsSetValue
TlsGetValue
TlsAlloc
TlsFree
GetVersion
mscat32
CryptCATCatalogInfoFromContext
CryptCATAdminEnumCatalogFromHash
CryptCATAdminAcquireContext
CryptCATAdminReleaseContext
msvcrt
_adjust_fdiv
_initterm
free
wcsrchr
_wcsnicmp
wcscmp
_vsnprintf
_except_handler3
wcsncpy
strrchr
memmove
_purecall
??2@YAPAXI@Z
??3@YAXPAX@Z
wcslen
wcsncmp
malloc
_vsnwprintf
wcscpy
_wcsicmp
__CxxFrameHandler
ole32
CoCreateGuid
StringFromCLSID
CoTaskMemFree
CLSIDFromString
Sections
.text Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 876B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 2KB - Virtual size: 13B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.aadata Size: 2KB - Virtual size: 484B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.iq Size: 76KB - Virtual size: 75KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.o99pa Size: 2KB - Virtual size: 138B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.o9code Size: 2KB - Virtual size: 202B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.aao Size: 2KB - Virtual size: 188B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.obb2 Size: 2KB - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.obb3 Size: 2KB - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hoo2 Size: 2KB - Virtual size: 1000B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.hoo00 Size: 2KB - Virtual size: 1000B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.oooa Size: 78KB - Virtual size: 77KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hoo4 Size: 2KB - Virtual size: 1000B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.hoo3 Size: 2KB - Virtual size: 1000B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.obb6 Size: 2KB - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.haa Size: 2KB - Virtual size: 100B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.obb Size: 76KB - Virtual size: 75KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.a0a0 Size: 2KB - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.obb4 Size: 2KB - Virtual size: 256B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.obb5 Size: 2KB - Virtual size: 6B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.haah Size: 76KB - Virtual size: 75KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.1a1a Size: 2KB - Virtual size: 36B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.4141 Size: 2KB - Virtual size: 103B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hoo Size: 2KB - Virtual size: 1000B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.sef Size: 76KB - Virtual size: 75KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hjgk Size: 2KB - Virtual size: 11B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.CRT Size: 2KB - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 18KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 406B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ