Static task
static1
Behavioral task
behavioral1
Sample
5a4ac31453f9c83c82ae5d7ed1e2d6b2_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
5a4ac31453f9c83c82ae5d7ed1e2d6b2_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5a4ac31453f9c83c82ae5d7ed1e2d6b2_JaffaCakes118
-
Size
468KB
-
MD5
5a4ac31453f9c83c82ae5d7ed1e2d6b2
-
SHA1
26fc48d4adf0761894aa8d7d4fb59c84a62e3133
-
SHA256
2d46fe98c5a3e8351983c895b8a9ce15364a9ed872cd11cef0fc839ab1914763
-
SHA512
474be6c2644061fe41794598b9719d024178b9a094fb29c016a1f907ccec800950d9b4379b776f070e9b3c521d615f79fc64fc440a7f3b8cca42a6955ff3dd12
-
SSDEEP
12288:B/3KBaDVuotwC559JYz4aysshaGpPpFOEh1Xpr3IXGTTJEdI:B/3EaDVrwC55gfxsZP+EhFt3IXJi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5a4ac31453f9c83c82ae5d7ed1e2d6b2_JaffaCakes118
Files
-
5a4ac31453f9c83c82ae5d7ed1e2d6b2_JaffaCakes118.exe windows:4 windows x86 arch:x86
5b747577b975fa01cb3d4c4da28e7552
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WinExec
WaitForSingleObject
CreateProcessA
CreateEventA
OpenMutexA
GetVolumeInformationA
GetSystemDirectoryA
GetWindowsDirectoryA
FreeLibrary
GetProcAddress
LoadLibraryA
SetSystemTime
GetSystemTime
MultiByteToWideChar
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetFileAttributesA
GetCommandLineA
LockResource
LoadResource
SizeofResource
FindResourceA
WriteFile
FlushFileBuffers
CreateFileA
CopyFileA
EnterCriticalSection
LeaveCriticalSection
InterlockedIncrement
InterlockedDecrement
GetModuleHandleA
GetVersionExA
GetModuleFileNameA
lstrlenW
WideCharToMultiByte
LoadLibraryExA
lstrcmpiA
lstrcpynA
IsDBCSLeadByte
GetSystemTimeAsFileTime
GetCurrentDirectoryA
ReadFile
DeviceIoControl
GetFullPathNameA
GetDriveTypeA
FileTimeToLocalFileTime
FileTimeToSystemTime
MoveFileExA
GetCurrentThreadId
GetShortPathNameA
LocalFree
CreateToolhelp32Snapshot
Process32First
GetPrivateProfileSectionA
OpenProcess
CloseHandle
Process32Next
RaiseException
DeleteCriticalSection
InitializeCriticalSection
FindFirstFileA
CreateFileMappingA
GetProcessHeap
SetFileAttributesA
DeleteFileA
FindNextFileA
GetLastError
FindClose
GetLogicalDrives
CreateDirectoryA
SetEndOfFile
GetTempPathA
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetEnvironmentVariableA
lstrlenA
ExitProcess
RtlUnwind
HeapFree
MoveFileA
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapAlloc
HeapReAlloc
GetStartupInfoA
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
HeapSize
HeapDestroy
HeapCreate
VirtualFree
IsBadWritePtr
LCMapStringA
LCMapStringW
GetOEMCP
GetCPInfo
SetUnhandledExceptionFilter
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
SetFilePointer
GetStringTypeA
GetStringTypeW
IsBadReadPtr
IsBadCodePtr
SetStdHandle
GetTimeZoneInformation
user32
DefWindowProcA
DestroyWindow
CharNextA
advapi32
RegSetValueA
RegQueryInfoKeyA
RegSetValueExA
RegEnumKeyExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
RegQueryValueA
GetUserNameA
CreateProcessAsUserA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegCreateKeyA
RegEnumValueA
OpenProcessToken
RegNotifyChangeKeyValue
ole32
CoTaskMemAlloc
CoTaskMemFree
CoUninitialize
CoInitialize
CoCreateInstance
CoTaskMemRealloc
oleaut32
VarUI4FromStr
SysAllocString
VariantClear
comctl32
InitCommonControlsEx
gdi32
SelectObject
GetTextExtentPoint32A
shell32
SHGetFolderPathA
Sections
.text Size: 172KB - Virtual size: 169KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 264KB - Virtual size: 263KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ