Static task
static1
Behavioral task
behavioral1
Sample
4cc088f40f257020202d83edfe8ee451_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
4cc088f40f257020202d83edfe8ee451_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
4cc088f40f257020202d83edfe8ee451_JaffaCakes118
-
Size
467KB
-
MD5
4cc088f40f257020202d83edfe8ee451
-
SHA1
246e1c190e1ec3f8aacafe96e70d07f2542068ac
-
SHA256
f38fab2e261a097a6d9861a3922499a643b7698094f643a63785fe8914391d65
-
SHA512
78ea09e8e84d6b43124b50b327c76bbbe1ef0b71a52d24afa627678837fc405a2b8b6e742d9c30e5acc340334f36c057c4c371a12114d8efb3ac40087319a3a6
-
SSDEEP
12288:WeX0u3pjEkDQX0TJvA3WnO+HKWp0CBCXIkVxEKqyexVqNsPrlo/ZENaJENn9RPoK:d0u3pjEkDQX0TJvA3UPtpfBCYkVxEKqx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4cc088f40f257020202d83edfe8ee451_JaffaCakes118
Files
-
4cc088f40f257020202d83edfe8ee451_JaffaCakes118.exe windows:4 windows x86 arch:x86
877cd697af8024b45cbd600ea522883c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RevertToSelf
CreateServiceA
CryptDestroyHash
RegEnumValueA
RegQueryValueA
RegConnectRegistryA
RegSetValueA
CryptAcquireContextA
RegQueryValueExW
RegNotifyChangeKeyValue
CryptCreateHash
RegEnumKeyW
DuplicateTokenEx
InitiateSystemShutdownA
CryptEncrypt
RegLoadKeyW
LookupAccountSidW
RegQueryValueExA
RegOpenKeyA
CryptEnumProviderTypesA
RegRestoreKeyA
LogonUserW
RegEnumValueW
RegOpenKeyExW
RegCreateKeyW
comctl32
MakeDragList
ImageList_LoadImageW
ImageList_ReplaceIcon
ImageList_GetIconSize
ImageList_Remove
CreatePropertySheetPage
ImageList_LoadImage
CreatePropertySheetPageW
ImageList_GetIcon
ImageList_Merge
ImageList_SetOverlayImage
InitCommonControlsEx
ImageList_DragLeave
DrawStatusTextA
ImageList_GetFlags
CreateStatusWindowA
ImageList_EndDrag
user32
CreateWindowExA
RegisterClassExA
RegisterClassA
MessageBoxW
ShowWindow
SetWindowWord
DlgDirSelectComboBoxExA
kernel32
GetACP
GetCompressedFileSizeW
FlushFileBuffers
GetVersion
RtlUnwind
GetOEMCP
GetStartupInfoA
LCMapStringA
GetCurrentProcess
LeaveCriticalSection
SetFilePointer
GetTickCount
SetStdHandle
GetCurrentThread
GetSystemTimeAsFileTime
IsBadWritePtr
GetLocalTime
GetLastError
SetConsoleOutputCP
EnumSystemCodePagesW
VirtualFree
GetModuleFileNameA
HeapReAlloc
ReadFile
GetTimeZoneInformation
VirtualAlloc
GetStringTypeW
SetHandleCount
GetEnvironmentStringsW
TerminateProcess
ExitProcess
TlsAlloc
SetUnhandledExceptionFilter
SetLastError
GetSystemTime
GetCPInfo
WideCharToMultiByte
HeapAlloc
CompareStringW
QueryPerformanceCounter
WriteFile
GetSystemInfo
SetEnvironmentVariableA
FreeEnvironmentStringsW
TlsGetValue
VirtualQuery
HeapCreate
FreeEnvironmentStringsA
SetLocaleInfoW
MultiByteToWideChar
GetStdHandle
GetTempPathW
GetEnvironmentStrings
CompareStringA
DeleteFileA
LCMapStringW
GetCurrentProcessId
InterlockedIncrement
UnhandledExceptionFilter
GetModuleHandleA
EnterCriticalSection
HeapDestroy
DeleteCriticalSection
GlobalGetAtomNameA
HeapFree
SetConsoleCursorPosition
CloseHandle
InitializeCriticalSection
GetCurrentThreadId
InterlockedExchange
CreateMutexA
TlsSetValue
OpenMutexA
InterlockedDecrement
LoadLibraryA
GlobalAddAtomA
TlsFree
GetCommandLineA
GetStringTypeA
SetEvent
GetProcAddress
GetFileType
Sections
.text Size: 311KB - Virtual size: 311KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 38KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 101KB - Virtual size: 101KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ