Static task
static1
Behavioral task
behavioral1
Sample
4a150b50047649c1a05f939e25397675_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
4a150b50047649c1a05f939e25397675_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
4a150b50047649c1a05f939e25397675_JaffaCakes118
-
Size
432KB
-
MD5
4a150b50047649c1a05f939e25397675
-
SHA1
3ebf84f8307b87c85806085e6d4afa609eb0fdce
-
SHA256
42321a4a95da21922ca913b46af3e0a0a1c39d35111e923f60a9feb151df5468
-
SHA512
9ebe9df93e909915831fccaf3c8f5e82c0a9d7c60152b754ab2d8e7bb99985befdb80e095b54005c8761543c638705876db7cd6350c930b78c91c46f04e150bc
-
SSDEEP
12288:PObNZSz7JN+msCQLY4K3Q9lXr1Ux/dZDV3:PObvK3jtQc4K3Q9hw1Zx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4a150b50047649c1a05f939e25397675_JaffaCakes118
Files
-
4a150b50047649c1a05f939e25397675_JaffaCakes118.exe windows:4 windows x86 arch:x86
0c3d73cf0c46fdd4f1045a8bdc35d362
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FormatMessageA
GetPrivateProfileIntA
LeaveCriticalSection
GetCurrentThreadId
SetFileAttributesA
EnterCriticalSection
DeleteFileA
CopyFileA
GetTempFileNameA
LoadLibraryA
ReadProcessMemory
GetCurrentProcessId
GetCurrentThread
IsBadReadPtr
lstrcmpW
InterlockedDecrement
InterlockedIncrement
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
lstrlenW
SizeofResource
LocalFree
GetModuleHandleA
IsBadCodePtr
TlsAlloc
TlsSetValue
SetEnvironmentVariableA
GetLocaleInfoW
SetEndOfFile
ReadFile
CreateFileA
SetStdHandle
SetConsoleCtrlHandler
GetProcAddress
GetUserDefaultLCID
IsValidCodePage
IsValidLocale
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
DeleteCriticalSection
InitializeCriticalSection
GetTempPathA
CreateDirectoryA
GlobalMemoryStatus
GetLocalTime
GetLastError
VirtualQuery
GetModuleFileNameA
GetCurrentProcess
TerminateProcess
FindResourceA
GetOEMCP
GetACP
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
HeapSize
HeapReAlloc
GetVersion
GetCommandLineA
GetStartupInfoA
HeapFree
GetSystemTime
GetTimeZoneInformation
HeapDestroy
GetEnvironmentVariableA
SetFilePointer
GetFileType
GetStdHandle
SetHandleCount
WriteFile
FlushFileBuffers
CloseHandle
SetUnhandledExceptionFilter
FatalAppExitA
TlsGetValue
SetLastError
Sleep
InterlockedExchange
OutputDebugStringA
GetStringTypeA
GetStringTypeW
GetVersionExA
GetCPInfo
GetLocaleInfoA
LCMapStringA
LCMapStringW
CompareStringA
CompareStringW
lstrcmpiA
EnumSystemLocalesA
RtlUnwind
ExitProcess
RaiseException
HeapAlloc
TlsFree
user32
GetMessageA
SetTimer
TranslateMessage
PostMessageA
FindWindowA
RegisterWindowMessageA
RegisterClassExA
SendMessageA
IsWindow
DefWindowProcA
DispatchMessageA
CreateWindowExA
GetForegroundWindow
LoadStringA
MessageBoxA
KillTimer
PostQuitMessage
advapi32
RegCloseKey
GetUserNameA
RegLoadKeyA
RegRestoreKeyA
RegSaveKeyA
RegDeleteValueA
RegDeleteKeyA
RegQueryValueExA
RegSetValueExA
RegCreateKeyExA
RegOpenKeyExA
shell32
ShellExecuteA
ole32
CoCreateInstance
CoInitialize
CoUninitialize
oleaut32
SysStringLen
VariantChangeType
SysAllocString
VariantInit
VariantCopy
VariantClear
SysFreeString
GetErrorInfo
SetErrorInfo
CreateErrorInfo
imagehlp
SymGetSymFromAddr
StackWalk
SymFunctionTableAccess
SymGetModuleBase
shlwapi
UrlGetPartA
UrlCanonicalizeA
UrlCompareA
ws2_32
gethostbyname
WSAStartup
WSACleanup
Sections
.text Size: 356KB - Virtual size: 353KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 40KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 32KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE