Static task
static1
Behavioral task
behavioral1
Sample
5a907ce71ee91b4e6e97e0ca27097b70_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
5a907ce71ee91b4e6e97e0ca27097b70_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5a907ce71ee91b4e6e97e0ca27097b70_JaffaCakes118
-
Size
190KB
-
MD5
5a907ce71ee91b4e6e97e0ca27097b70
-
SHA1
9b2b5061089d50855a2b1499c1675dbd14d02052
-
SHA256
cc2f63a1497929e91cede214bfbca74cbe85bfc56865da96de1312455109e996
-
SHA512
d8bb1dcd369013b36595c9bfefbda30ce8bb250e587d855fb6d858ca3fb4560d9ffa5f23fb7d88b7c787c4697126d9d4d649d5d1d399ee01f52758854515a3bd
-
SSDEEP
3072:lEwhQB+/CqdIwucugOe1QEBbeQZ2z0BZO/vtxBdlpZYX:Wt2CAu5e1QEL3ZOrLZS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5a907ce71ee91b4e6e97e0ca27097b70_JaffaCakes118
Files
-
5a907ce71ee91b4e6e97e0ca27097b70_JaffaCakes118.exe windows:5 windows x86 arch:x86
b02efe3c6e07b81e751756fb0cb46e08
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetDriveTypeW
FindFirstVolumeW
DeleteFileW
FindNextVolumeW
FindVolumeClose
GetVolumePathNamesForVolumeNameW
GetFileInformationByHandle
CreateFileW
GetFileSize
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
CloseHandle
lstrcpyW
FileTimeToLocalFileTime
FileTimeToSystemTime
MultiByteToWideChar
WideCharToMultiByte
GetLastError
IsBadReadPtr
DeleteCriticalSection
GetCommandLineW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
GetModuleHandleA
LocalAlloc
LocalFree
GetVolumeNameForVolumeMountPointW
ExpandEnvironmentStringsW
ReleaseMutex
WaitForSingleObject
OpenMutexW
CreateMutexW
FindFirstFileW
FindNextFileW
FindClose
HeapFree
ReadFile
lstrcatW
IsBadWritePtr
GetProcessHeap
HeapAlloc
lstrcmpiW
lstrlenW
CreateFileA
FileTimeToDosDateTime
GetFileAttributesA
GetCurrentThreadId
SetLastError
user32
wsprintfW
advapi32
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetSecurityInfo
SetEntriesInAclW
AllocateAndInitializeSid
RegQueryValueExW
RegOpenKeyExW
RegEnumKeyW
RegCloseKey
RegEnumValueW
RegOpenKeyW
CloseEventLog
ReadEventLogW
OpenEventLogW
FreeSid
version
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
cabinet
ord10
ord11
ord13
ord14
msvcrt
_exit
_c_exit
_wtol
wcsncmp
wcsrchr
wcsncpy
_tempnam
_lseek
_close
_write
_read
_open
remove
_errno
__doserrno
memmove
_CxxThrowException
time
localtime
wcsftime
printf
fread
_cexit
free
__CxxFrameHandler
_waccess
_iob
_wfopen
exit
__initenv
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
??1type_info@@UAE@XZ
__dllonexit
fclose
fprintf
wcscat
swscanf
swprintf
wcscpy
_wgetenv
_wenviron
_environ
wcschr
_wcsnicmp
_wcsicmp
wcscmp
sscanf
sprintf
wcslen
towlower
_onexit
_except_handler3
_controlfp
malloc
?terminate@@YAXXZ
_XcptFilter
Sections
.text Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
PACK Size: 144KB - Virtual size: 380KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE