Static task
static1
Behavioral task
behavioral1
Sample
4a7dc8f8555ecd2f1ebf5f9c0cd21947_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
4a7dc8f8555ecd2f1ebf5f9c0cd21947_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
4a7dc8f8555ecd2f1ebf5f9c0cd21947_JaffaCakes118
-
Size
162KB
-
MD5
4a7dc8f8555ecd2f1ebf5f9c0cd21947
-
SHA1
bd81c075140e7cf0b4495bcfc8d53bd7393d3ac5
-
SHA256
c66847eeb5d95028f2cbd4a752fea88153b821d6e12661b8811504a0d8a60090
-
SHA512
fd7a4e27aa1d92eb5e1d519bf11ffed61234be65210d5fc3af9886c01044f1614ff10b7d6504789b01c7895a03fdb615f7e7ce0d38f94f7cb3e81f816a957338
-
SSDEEP
3072:2GXTOOUu115Q2ZXJH1VC8CSzhYY6UvwzbfZw34A3YdJDNx:nUGNJHTCvu6kwzrZwoA3YdRNx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4a7dc8f8555ecd2f1ebf5f9c0cd21947_JaffaCakes118
Files
-
4a7dc8f8555ecd2f1ebf5f9c0cd21947_JaffaCakes118.exe windows:4 windows x86 arch:x86
9a6781609b1138e24c199318f6807db8
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mprapi
MprConfigServerConnect
MprConfigServerDisconnect
MprConfigGetFriendlyName
oleacc
LresultFromObject
AccessibleObjectFromPoint
shell32
SHGetFolderPathW
kernel32
WriteConsoleA
HeapCreate
HeapDestroy
LCMapStringA
MultiByteToWideChar
UnhandledExceptionFilter
HeapFree
IsValidCodePage
GetCurrentProcess
GetTimeZoneInformation
GetTimeFormatA
GetCPInfo
SetUnhandledExceptionFilter
RtlUnwind
FreeLibrary
LoadLibraryA
WriteFile
SetEndOfFile
ReadFile
GetACP
EnumResourceTypesA
LCMapStringW
VirtualFree
VirtualAlloc
HeapSize
RaiseException
GetStringTypeW
CompareStringW
GetCurrentProcessId
IsDebuggerPresent
CreateNamedPipeA
EnterCriticalSection
GetDateFormatA
LeaveCriticalSection
SetFilePointer
SetEnvironmentVariableA
QueryPerformanceCounter
GetOEMCP
GetLocaleInfoA
CompareStringA
TerminateProcess
GetConsoleOutputCP
GetTickCount
InitializeCriticalSection
SetStdHandle
HeapReAlloc
GetSystemTimeAsFileTime
GetStringTypeA
advapi32
CloseServiceHandle
RegOpenKeyExW
CreateServiceW
EqualSid
LookupPrivilegeNameA
LookupPrivilegeValueA
RegEnumKeyExW
SetSecurityDescriptorDacl
FreeInheritedFromArray
RegGetKeySecurity
RegDeleteValueW
RegSetValueExW
IsValidAcl
LookupAccountSidW
EnumDependentServicesW
RegDeleteKeyW
GetSecurityDescriptorControl
UnlockServiceDatabase
OpenSCManagerW
OpenProcessToken
InitializeAcl
ChangeServiceConfigW
AllocateAndInitializeSid
GetInheritanceSourceW
AdjustTokenPrivileges
LookupPrivilegeDisplayNameA
ControlService
ChangeServiceConfig2W
SetNamedSecurityInfoW
RegCloseKey
RegQueryValueExW
QueryServiceStatus
StartServiceA
GetTokenInformation
LockServiceDatabase
GetNamedSecurityInfoW
AddAce
OpenServiceW
IsValidSecurityDescriptor
GetSecurityInfo
GetAce
RegSaveKeyW
QueryServiceLockStatusW
FreeSid
RegRestoreKeyW
InitializeSecurityDescriptor
DeleteService
RegCreateKeyExW
SetSecurityInfo
QueryServiceConfigW
GetAclInformation
SetEntriesInAclW
SetEntriesInAclA
RegEnumValueW
newdev
UpdateDriverForPlugAndPlayDevicesW
Sections
.text Size: 44KB - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 407KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 113KB - Virtual size: 113KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ