Static task
static1
Behavioral task
behavioral1
Sample
4b5ed8510901ed974f8187e528a87517_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
4b5ed8510901ed974f8187e528a87517_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
4b5ed8510901ed974f8187e528a87517_JaffaCakes118
-
Size
348KB
-
MD5
4b5ed8510901ed974f8187e528a87517
-
SHA1
0d450b8fc1fc8c4fa7b3976344ec4dd32ecf1941
-
SHA256
9150bfb08b83bde127e5b04ef18532d4bfe3ac1bd32dc47b128022b6d2dc5ee2
-
SHA512
0dff1c172212a49b93152154761b578587f61ad30fa5044603012f5aafad7dacaf655a4251421543f09a9f08064229bfa645d07f06eaa9a521b39c08efc6981a
-
SSDEEP
6144:X8v59KfrmIrERGYPjjqZsZ40zgfckZgw3Wv1Wfrk7GRJDKkIw6F6wCxqF1wg:K59KzmIroGcqZsEckZVmtwgKRQkcF674
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4b5ed8510901ed974f8187e528a87517_JaffaCakes118
Files
-
4b5ed8510901ed974f8187e528a87517_JaffaCakes118.exe windows:4 windows x86 arch:x86
0658500238b184584aa200033d26cb68
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ReadConsoleA
SetProcessAffinityMask
GetSystemTimeAdjustment
GetDriveTypeW
lstrcatW
VirtualQuery
CloseHandle
OpenMutexA
GetPrivateProfileStringW
GlobalFree
FreeLibraryAndExitThread
ReadConsoleOutputA
SetSystemTime
RaiseException
QueryDosDeviceA
SetCurrentDirectoryA
CreateIoCompletionPort
_lopen
CancelIo
GetProcessHeap
UnhandledExceptionFilter
ScrollConsoleScreenBufferA
GetUserDefaultLangID
SetCommMask
IsBadWritePtr
SetFileAttributesA
FindNextChangeNotification
ReadDirectoryChangesW
PeekConsoleInputW
GetUserDefaultLCID
GetCurrentProcess
PrepareTape
GetLargestConsoleWindowSize
PeekNamedPipe
OutputDebugStringA
SetProcessWorkingSetSize
GetBinaryTypeW
SetCommTimeouts
SetProcessShutdownParameters
GlobalReAlloc
LoadLibraryExA
GetSystemTimeAsFileTime
lstrcmpiW
DuplicateHandle
EnumResourceLanguagesW
WritePrivateProfileStructA
SetHandleCount
EndUpdateResourceA
LeaveCriticalSection
CopyFileExW
LocalLock
WaitNamedPipeA
_lclose
GetCurrentDirectoryW
WriteFile
SetEvent
MoveFileW
SetConsoleActiveScreenBuffer
GetSystemInfo
GetCommandLineA
CreateEventA
EnumTimeFormatsW
QueryDosDeviceW
TlsGetValue
PulseEvent
CreateDirectoryW
GetHandleInformation
GetEnvironmentStringsW
EnumSystemCodePagesW
GetSystemDefaultLangID
GetVersion
FreeResource
IsDBCSLeadByteEx
GlobalUnlock
GetFileAttributesA
GetVersionExA
lstrlenA
VirtualProtect
EnumResourceNamesW
ExitProcess
user32
LoadKeyboardLayoutA
SetCapture
RegisterHotKey
WindowFromDC
GetPropW
DrawTextW
GetCaretPos
PostQuitMessage
RegisterWindowMessageA
RedrawWindow
ShowOwnedPopups
GetKeyboardLayoutNameA
AppendMenuW
SetMenuInfo
PeekMessageA
GetDlgItemInt
GetIconInfo
IsCharLowerW
SetWindowsHookExA
MapVirtualKeyW
GetParent
GetWindowThreadProcessId
IsZoomed
SetRect
RegisterDeviceNotificationW
FlashWindow
GetKeyboardLayout
DrawTextA
EnableWindow
DragDetect
OffsetRect
GetDlgItem
GetCapture
comdlg32
ChooseColorA
advapi32
ObjectCloseAuditAlarmA
SetSecurityDescriptorSacl
IsTextUnicode
RegSaveKeyA
GetSidSubAuthority
AddAccessDeniedAce
SetTokenInformation
SetSecurityDescriptorDacl
PrivilegeCheck
AccessCheckAndAuditAlarmW
GetUserNameW
InitializeAcl
EnumDependentServicesA
OpenSCManagerW
CryptImportKey
shell32
SHBrowseForFolderA
FindExecutableA
SHGetSpecialFolderLocation
ExtractIconExW
SHGetPathFromIDListA
SHGetDesktopFolder
ole32
MkParseDisplayName
OleInitialize
OleQueryLinkFromData
OleSetClipboard
GetRunningObjectTable
comctl32
ImageList_GetIcon
ImageList_DragShowNolock
ImageList_SetImageCount
shlwapi
StrCpyW
PathIsSameRootW
StrDupA
PathIsFileSpecA
wnsprintfA
PathIsRootW
PathRemoveBackslashA
PathRemoveFileSpecW
StrPBrkW
setupapi
SetupFindFirstLineA
SetupDiGetClassDevsExW
Sections
.text Size: 332KB - Virtual size: 330KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE