Static task
static1
Behavioral task
behavioral1
Sample
5bedc22bee2d4da24ee8b9d421d588f5_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5bedc22bee2d4da24ee8b9d421d588f5_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5bedc22bee2d4da24ee8b9d421d588f5_JaffaCakes118
-
Size
200KB
-
MD5
5bedc22bee2d4da24ee8b9d421d588f5
-
SHA1
5da54a7d4a9a800c795ad3b13078e8ff1618bd38
-
SHA256
540b96eb89b27e0bf439e21c8bf329fef50c3ef0545b8adc88abf1e5ae027c09
-
SHA512
ecd8a2bbadd42e05294bdc9aa07d95c139ae1cb6424a85967aa7059cdabb8522fd13cf6bc966734b4d532fd8e258bb0fdc867ac50a3182ef66755dbdd7bbe1e2
-
SSDEEP
3072:eomhwYXySOS+UfLhTGr007LC15ENQGURFvFsrGyBN7JZES7B3UrQZf:eNjyvkThTkj7C5ENkFoVES9
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5bedc22bee2d4da24ee8b9d421d588f5_JaffaCakes118
Files
-
5bedc22bee2d4da24ee8b9d421d588f5_JaffaCakes118.exe windows:4 windows x86 arch:x86
beb6c791a147c0222f6e1e7f1fdb971e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
lz32
LZCopy
LZOpenFileA
LZClose
kernel32
CreateProcessA
GetConsoleMode
GetConsoleCP
SetStdHandle
InitializeCriticalSection
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
HeapSize
LCMapStringW
WideCharToMultiByte
LCMapStringA
WriteFile
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetFileType
GetStdHandle
SetHandleCount
GetStringTypeW
WaitForSingleObject
GetStringTypeA
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
ExitProcess
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetCurrentThreadId
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetOEMCP
GetACP
GetCPInfo
GetStartupInfoA
RtlUnwind
RaiseException
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedDecrement
InterlockedIncrement
OutputDebugStringA
GetCommandLineA
LoadLibraryA
FreeLibrary
Sleep
RemoveDirectoryA
GetShortPathNameA
GetFileAttributesA
WritePrivateProfileStringA
lstrcmpA
MulDiv
GetModuleFileNameA
UnmapViewOfFile
CreateFileMappingA
MapViewOfFile
ReadFile
GetVersionExA
GetCurrentProcess
GetProcessHeap
HeapAlloc
HeapFree
GetSystemDirectoryA
GetTempPathA
GetTempFileNameA
CreateDirectoryA
SetFileAttributesA
DeleteFileA
FindNextFileA
MoveFileExA
FindFirstFileA
FindClose
CreateFileA
GetLastError
CloseHandle
GetPrivateProfileIntA
GetPrivateProfileStringA
lstrcatA
GetWindowsDirectoryA
SetThreadLocale
lstrcpynA
lstrcpyA
lstrcmpiA
GetSystemDefaultLCID
lstrlenA
GetLocaleInfoA
GetModuleHandleA
GetProcAddress
FlushFileBuffers
SetFilePointer
GetLocaleInfoW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEndOfFile
MultiByteToWideChar
user32
IsDialogMessageA
TranslateMessage
DispatchMessageA
CreateWindowExA
LoadIconA
FindWindowA
PostQuitMessage
DefWindowProcA
GetSystemMenu
RemoveMenu
PostMessageA
MessageBoxA
BeginPaint
EndPaint
GetUpdateRect
SetDlgItemTextA
DestroyWindow
CreateDialogParamA
ShowWindow
OffsetRect
DrawTextA
IsWindow
CopyRect
UpdateWindow
GetWindowDC
SystemParametersInfoA
LoadCursorA
RegisterClassA
GetSystemMetrics
FindWindowExA
SetWindowTextA
SetWindowPos
CharNextA
GetDC
GetClientRect
ReleaseDC
InvalidateRect
GetWindowLongA
GetWindowRect
SendMessageA
SetWindowLongA
wsprintfA
GetMessageA
GetSysColor
gdi32
CreateDIBitmap
CreateDIBSection
CreatePalette
SetBkMode
GetTextColor
CreateRectRgn
Polygon
ExtSelectClipRgn
RealizePalette
CreatePatternBrush
CreateCompatibleDC
CreateCompatibleBitmap
DeleteDC
SetStretchBltMode
StretchBlt
SetBkColor
SetTextColor
BitBlt
CreateSolidBrush
GetDeviceCaps
GetObjectA
GetStockObject
DeleteObject
SelectPalette
CreateFontA
SetBrushOrgEx
SelectObject
advapi32
GetLengthSid
InitializeAcl
AddAccessAllowedAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegSetKeySecurity
RegCloseKey
FreeSid
RegEnumKeyExA
RegSetValueExA
RegQueryValueExA
RegCreateKeyExA
RegOpenKeyExA
AllocateAndInitializeSid
shell32
FindExecutableA
shlwapi
SHDeleteKeyA
Sections
.text Size: 128KB - Virtual size: 124KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 16KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ