Static task
static1
Behavioral task
behavioral1
Sample
5c6b8672387875ece11f90d5ba14e5a2_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5c6b8672387875ece11f90d5ba14e5a2_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5c6b8672387875ece11f90d5ba14e5a2_JaffaCakes118
-
Size
25KB
-
MD5
5c6b8672387875ece11f90d5ba14e5a2
-
SHA1
c5e1fdd77ccac1fafb293065a68ba635dafb83ab
-
SHA256
8cc2688164b5eb57907d0063f34e3347ed95d959b0f03f94e1684aecc3da31f4
-
SHA512
69f4e50fa929503fb8049b16069f14ce4686a4520b02979b0e14d8ef5dd12f386182a2bae8b650365697de491d95f070e0ca71de90012496561597fed0e1ab61
-
SSDEEP
768:M1T9jSXOSYBY6cfNb0UoLS2ohORhGsuWlptf7To0XBO:MF9O+SYB9y0fEh0hG8lplo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5c6b8672387875ece11f90d5ba14e5a2_JaffaCakes118
Files
-
5c6b8672387875ece11f90d5ba14e5a2_JaffaCakes118.exe windows:4 windows x86 arch:x86
648f1b21c7d087e8c964193ce261b26f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntdll
NtCreateKey
ws2_32
WSAGetLastError
advapi32
RegCreateKeyA
RegCloseKey
RegOpenKeyA
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
ddraw
DDInternalLock
ReleaseDDThreadLock
CompleteCreateSysmemSurface
D3DParseUnknownCommand
AcquireDDThreadLock
DDInternalUnlock
kernel32
LocalAlloc
GetCurrentProcess
SetUnhandledExceptionFilter
GetCurrentThreadId
GetVersionExA
GetTickCount
GetSystemInfo
GetCurrentProcessId
VirtualFree
LocalFree
IsBadReadPtr
DisableThreadLibraryCalls
LoadLibraryA
UnhandledExceptionFilter
GetProcAddress
IsBadCodePtr
GetModuleFileNameA
Sleep
QueryPerformanceCounter
FreeLibrary
VirtualAlloc
TerminateProcess
GetModuleHandleA
LocalReAlloc
GetSystemTimeAsFileTime
user32
IntersectRect
IsRectEmpty
msvcrt
ftell
_CIpow
__dllonexit
free
fclose
fflush
_initterm
fwrite
_CIsqrt
fopen
_onexit
_except_handler3
sprintf
_CxxThrowException
_CIexp
_adjust_fdiv
malloc
fseek
_purecall
__CxxFrameHandler
exp
dhcpcsvc
McastApiStartup
Sections
.textbss Size: - Virtual size: 96KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.idata Size: 22KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 216B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE