Static task
static1
Behavioral task
behavioral1
Sample
480a6ff02cd2c6c7966388258b33a35a_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
480a6ff02cd2c6c7966388258b33a35a_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
480a6ff02cd2c6c7966388258b33a35a_JaffaCakes118
-
Size
295KB
-
MD5
480a6ff02cd2c6c7966388258b33a35a
-
SHA1
24e124e9a747ea37a1f0f325bc1b0c1176297a3c
-
SHA256
381c50d6d0560cdd7f1ee522630268423eb6a438f59f407aa87b299aac74df2d
-
SHA512
e2470b88b0a1d687187642c17b7fa1c07b5e9a1c5b43da83580b6b62a095d9bbe25f94a9e3e54cb0f10b9366e2681db1c22d0a7b7db6c65190b284fed221138f
-
SSDEEP
3072:nRbeu9a9mmvviiwfanOxMnHOzrf96kF2xlKSaAcZiNrv7yChUk9iGMg3rGnSJhf:nJetmYviiganOkH91xldT7ySpN3Knq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 480a6ff02cd2c6c7966388258b33a35a_JaffaCakes118
Files
-
480a6ff02cd2c6c7966388258b33a35a_JaffaCakes118.exe windows:4 windows x86 arch:x86
c6998e6e03e8decfcfc18993c29c591c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
RemoveDirectoryA
VirtualAlloc
GetCommandLineA
QueryDosDeviceW
EnumSystemCodePagesA
FormatMessageW
GetHandleInformation
GetAtomNameA
SetCurrentDirectoryA
EnumCalendarInfoW
DeleteCriticalSection
GetFullPathNameA
GetFileInformationByHandle
DebugBreak
SetSystemTime
GetModuleHandleA
SearchPathW
CloseHandle
ConnectNamedPipe
_llseek
GetSystemDefaultLangID
GetDiskFreeSpaceExA
LeaveCriticalSection
SetConsoleWindowInfo
EnumSystemCodePagesW
EraseTape
RaiseException
OutputDebugStringW
GetTempFileNameA
FlushConsoleInputBuffer
SetupComm
LoadResource
ExpandEnvironmentStringsW
WriteProcessMemory
GetTempPathW
WritePrivateProfileStructA
SetHandleCount
LocalReAlloc
GetDriveTypeW
EndUpdateResourceA
FindFirstFileExW
SetEndOfFile
GetSystemTime
CreateNamedPipeW
GetDiskFreeSpaceW
ExitProcess
FlushFileBuffers
ReleaseMutex
FindNextChangeNotification
GetEnvironmentVariableW
GetStartupInfoA
IsProcessorFeaturePresent
GetLargestConsoleWindowSize
PurgeComm
GetCommandLineW
DuplicateHandle
CreateMutexA
_lopen
user32
GetKeyNameTextA
IsCharUpperW
CreateCaret
WindowFromPoint
GetScrollRange
SetWinEventHook
RegisterClassW
gdi32
SetArcDirection
TextOutA
GetBitmapBits
GetDCOrgEx
GetViewportOrgEx
CopyMetaFileA
FillPath
RestoreDC
GetDIBColorTable
BitBlt
OffsetWindowOrgEx
SetPaletteEntries
IntersectClipRect
CreatePalette
comdlg32
GetOpenFileNameA
ChooseColorW
advapi32
RegCreateKeyExW
SetSecurityDescriptorOwner
RegRestoreKeyA
CryptGetHashParam
RegQueryValueExA
CryptAcquireContextA
SetTokenInformation
NotifyBootConfigStatus
CryptHashData
GetFileSecurityA
GetUserNameA
LookupPrivilegeNameA
CreateProcessAsUserA
OpenProcessToken
RegEnumKeyA
CryptCreateHash
LogonUserW
AdjustTokenPrivileges
CreateProcessAsUserW
QueryServiceConfigW
RegisterEventSourceA
CopySid
RegDeleteKeyW
GetCurrentHwProfileW
RegCloseKey
AllocateLocallyUniqueId
CryptImportKey
ChangeServiceConfigA
InitializeSid
RevertToSelf
ObjectDeleteAuditAlarmW
BuildSecurityDescriptorW
DuplicateToken
CryptSetKeyParam
BuildTrusteeWithNameW
RegQueryInfoKeyA
CryptGenRandom
AddAce
RegRestoreKeyW
GetNamedSecurityInfoW
GetExplicitEntriesFromAclW
shell32
SHLoadInProc
SHGetSpecialFolderPathW
DragAcceptFiles
Shell_NotifyIconW
SHGetSpecialFolderPathA
ole32
CoReleaseServerProcess
CoCreateInstance
CoRegisterMallocSpy
GetRunningObjectTable
CLSIDFromString
OleBuildVersion
OleLockRunning
OleQueryLinkFromData
oleaut32
VariantChangeType
SafeArrayUnaccessData
LoadTypeLibEx
SafeArrayGetLBound
QueryPathOfRegTypeLi
SysStringLen
SysFreeString
comctl32
ImageList_Merge
ImageList_GetImageInfo
ImageList_DragShowNolock
PropertySheetA
Sections
akauoyy Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
wkociy Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
aseeyo Size: 278KB - Virtual size: 277KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
uasois Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ