Static task
static1
Behavioral task
behavioral1
Sample
59f134d34989a196c93b424b8834b6c5_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
59f134d34989a196c93b424b8834b6c5_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
59f134d34989a196c93b424b8834b6c5_JaffaCakes118
-
Size
113KB
-
MD5
59f134d34989a196c93b424b8834b6c5
-
SHA1
afff1429591ee74a4dbfcbaacf0e85e32aa716bb
-
SHA256
6f9734d24af74870c526e28d13ad15a5429aa7db59e18f8147d88aed263e4ea3
-
SHA512
f5d72a8dce688bc87b0049fdff0477dcc520eaeceee21fcca56767b767ffdbaaf8634c21cd2d5c498ea0b1eeebda7fd1e0199be758562adffc73ed40d3b92332
-
SSDEEP
1536:04bySMT5ptsb9d61F/vxPPSxjXcLbG1gl8Sgd5hr0zMSwqJBKAD7Z:04b+d7QqVdLbG1Uw
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 59f134d34989a196c93b424b8834b6c5_JaffaCakes118
Files
-
59f134d34989a196c93b424b8834b6c5_JaffaCakes118.exe windows:4 windows x86 arch:x86
0f997822e50b9fbeb1605b1a68f58be1
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
atl
ord15
ord43
ord44
ord45
ord32
ord16
ord21
ord18
ord22
ntdll
RtlCreateUnicodeString
RtlFreeUnicodeString
kernel32
ResetEvent
GetCurrentThreadId
InitializeCriticalSection
GetSystemWindowsDirectoryW
GetVersion
GetFileAttributesW
GetProcAddress
WaitForSingleObject
SetEvent
GetModuleHandleW
LoadLibraryW
GetModuleHandleA
GlobalSize
CreateEventW
DeleteCriticalSection
CloseHandle
InterlockedExchange
InterlockedCompareExchange
QueryPerformanceCounter
GlobalAlloc
GlobalFree
FlushInstructionCache
GetCurrentProcess
InterlockedIncrement
InterlockedDecrement
lstrlenW
EnterCriticalSection
LeaveCriticalSection
GetLastError
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
GetModuleFileNameW
OutputDebugStringA
GetTickCount
GlobalUnlock
GlobalLock
Sleep
LocalFree
LocalAlloc
MultiByteToWideChar
FindClose
FindFirstFileW
FormatMessageW
CompareStringW
GetCommandLineW
GetFullPathNameW
ExpandEnvironmentStringsW
GetProcessHeap
HeapFree
HeapAlloc
LoadLibraryA
VirtualAlloc
CreateActCtxW
ReleaseActCtx
ActivateActCtx
DeactivateActCtx
VirtualFree
oleaut32
SysStringLen
SysAllocString
SafeArrayGetVartype
VariantClear
VariantInit
VariantChangeType
SafeArrayGetElement
SafeArrayGetUBound
SafeArrayGetLBound
SysAllocStringLen
SafeArrayUnaccessData
SafeArrayAccessData
SysFreeString
SafeArrayGetDim
ole32
CoInitialize
CoUninitialize
ReleaseStgMedium
CoCreateInstance
StringFromCLSID
CoTaskMemFree
CoTaskMemAlloc
CreateStreamOnHGlobal
StringFromGUID2
shlwapi
PathFindFileNameW
PathAddBackslashW
PathRemoveFileSpecW
PathStripPathW
secur32
TranslateNameW
ntdsapi
DsCrackNamesW
DsFreeNameResultW
activeds
ord13
ord9
Sections
CODE Size: 67KB - Virtual size: 80KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.abss Size: - Virtual size: 168KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
DATA Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.atls Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.shared Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ