Static task
static1
Behavioral task
behavioral1
Sample
5e2b4f53840c34f13d9644f48a61c2b8_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5e2b4f53840c34f13d9644f48a61c2b8_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5e2b4f53840c34f13d9644f48a61c2b8_JaffaCakes118
-
Size
296KB
-
MD5
5e2b4f53840c34f13d9644f48a61c2b8
-
SHA1
0d4805ee1b96639bed7db7559d16d1b885a8bba7
-
SHA256
3432eeee22180411add5269882945436dc2670b7091c4867fd437239f140c317
-
SHA512
9205902b10d838b98acea718e88391223e9d8947dd412f39e4abef5fe839d37dd43d7d037cc3d6f7b6a9b78e9401181cdcff8f215e4af08e1e3666085c135f64
-
SSDEEP
6144:WyNsgU0nbJx3NUqdimWxgxa5PmIePvyHRloIEJ:WcBWxgsxmx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5e2b4f53840c34f13d9644f48a61c2b8_JaffaCakes118
Files
-
5e2b4f53840c34f13d9644f48a61c2b8_JaffaCakes118.exe windows:4 windows x86 arch:x86
06504a3c68d986ab8326c238d833abc4
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetLastError
InitializeCriticalSection
DeleteCriticalSection
LockResource
FindResourceExW
SizeofResource
CreateFileW
MultiByteToWideChar
lstrlenA
GetACP
GetWindowsDirectoryW
CreateProcessW
GetVolumeInformationA
CreateToolhelp32Snapshot
ReadFile
GetFileTime
GetSystemDirectoryA
GetProcessHeap
GetFileSize
GetModuleFileNameA
GetVersionExA
GetTempPathA
Process32NextW
SetErrorMode
CreateProcessA
GetExitCodeThread
CreateThread
CreateEventW
TerminateThread
SetEvent
GetModuleFileNameW
WaitForMultipleObjects
FlushFileBuffers
SetFilePointer
SetStdHandle
WideCharToMultiByte
WaitForSingleObject
Sleep
FormatMessageW
HeapAlloc
GetTickCount
EnterCriticalSection
LocalFree
LeaveCriticalSection
LoadResource
WriteFile
lstrlenW
HeapReAlloc
HeapFree
CloseHandle
Process32FirstW
FindResourceW
SetEndOfFile
SetEnvironmentVariableW
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetConsoleMode
GetConsoleCP
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
CreateFileA
GetExitCodeProcess
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
LoadLibraryA
RaiseException
InterlockedExchange
GetLocaleInfoA
GetThreadLocale
HeapDestroy
HeapSize
InterlockedIncrement
InterlockedDecrement
VirtualProtect
VirtualAlloc
GetProcAddress
GetModuleHandleA
GetSystemInfo
VirtualQuery
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
DeleteFileW
GetLocalTime
ExitProcess
GetCommandLineA
GetStartupInfoA
RtlUnwind
LCMapStringA
LCMapStringW
GetCPInfo
GetStringTypeA
GetStringTypeW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
GetOEMCP
IsValidCodePage
HeapCreate
VirtualFree
GetStdHandle
GetFileAttributesW
SetHandleCount
GetFileType
user32
GetKeyboardState
GetActiveWindow
UnregisterClassA
advapi32
CloseServiceHandle
CreateServiceW
ChangeServiceConfig2W
StartServiceW
QueryServiceStatusEx
OpenSCManagerW
RegisterServiceCtrlHandlerW
SetServiceStatus
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
StartServiceCtrlDispatcherW
ole32
CLSIDFromProgID
CoCreateInstance
CoUninitialize
CoInitialize
StringFromCLSID
ws2_32
WSAEventSelect
WSAGetOverlappedResult
WSAResetEvent
freeaddrinfo
WSASend
getaddrinfo
WSAConnect
WSAEnumNetworkEvents
WSACreateEvent
WSASocketW
closesocket
WSAStartup
WSARecv
WSACloseEvent
WSACleanup
WSAGetLastError
WSASetEvent
WSASetLastError
Sections
.text Size: 244KB - Virtual size: 241KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 36KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ