Static task
static1
Behavioral task
behavioral1
Sample
5d1657cfacb249bcb357fcb7982c7f96_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
5d1657cfacb249bcb357fcb7982c7f96_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
5d1657cfacb249bcb357fcb7982c7f96_JaffaCakes118
-
Size
122KB
-
MD5
5d1657cfacb249bcb357fcb7982c7f96
-
SHA1
af78cab8ca9fd674c4959ac59f2ebc69e29fafb8
-
SHA256
66a5bed16f45452f3f916763ba8b6f8eee2bbc6b8a18fc81ea86bf9fde5cf7c2
-
SHA512
294dc9a3f32516a13724d29d42e5e359ac73ebe793e88aa5735b0509fd6beac21ee3d7ac2c684034992d06dd64bc05fb65800cf4fd8cca757054218a8b532344
-
SSDEEP
3072:FcpE0ZYQGgGuM1ZZc1DI7EpmS3Hwyi+674:ReYjuM17caEQujif8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5d1657cfacb249bcb357fcb7982c7f96_JaffaCakes118
Files
-
5d1657cfacb249bcb357fcb7982c7f96_JaffaCakes118.exe windows:5 windows x86 arch:x86
8842f758f4525348015886e6cc74c0fa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SizeofResource
FindResourceW
FindResourceExW
CloseHandle
CreateFileA
GetModuleFileNameA
ReadFile
lstrcmpiW
lstrcatW
lstrcpyW
GetVolumeInformationW
SetFilePointer
GetTickCount
GetPrivateProfileSectionA
GetPrivateProfileIntA
GetPrivateProfileStringA
Sleep
CopyFileA
WriteFile
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
FlushInstructionCache
GetCurrentProcess
SetLastError
GetFileAttributesA
CreateDirectoryA
Process32Next
Process32First
CreateToolhelp32Snapshot
LCMapStringW
HeapCreate
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
InterlockedDecrement
InterlockedIncrement
GetCPInfo
LockResource
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
ExitProcess
GetModuleHandleW
GetProcAddress
RtlUnwind
GetStartupInfoW
LoadResource
RaiseException
WideCharToMultiByte
GetTempFileNameA
HeapSetInformation
GetCommandLineA
DecodePointer
FlushFileBuffers
CreateFileW
WriteConsoleW
SetStdHandle
EncodePointer
InterlockedPopEntrySList
MultiByteToWideChar
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
InterlockedPushEntrySList
InterlockedCompareExchange
GetProcessHeap
HeapSize
GetConsoleMode
HeapReAlloc
GetConsoleCP
GetStringTypeW
LoadLibraryW
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameW
GetStdHandle
TerminateProcess
GetTempPathA
GetLastError
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
HeapDestroy
HeapAlloc
HeapFree
user32
CallWindowProcA
GetClassInfoExA
PostMessageA
DestroyWindow
GetWindowLongA
SetWindowLongA
KillTimer
SetTimer
PostQuitMessage
TranslateAcceleratorA
LoadAcceleratorsA
RegisterClassExA
LoadCursorA
DefWindowProcA
EndPaint
BeginPaint
CreateWindowExA
TranslateMessage
DispatchMessageA
GetMessageA
LoadStringA
UnregisterClassA
shell32
ShellExecuteA
SHGetSpecialFolderPathW
ole32
CoInitialize
CoCreateInstance
CoSetProxyBlanket
oleaut32
VariantInit
SysFreeString
SysAllocString
VariantClear
shlwapi
StrStrW
StrChrW
wvnsprintfW
StrCpyNW
ws2_32
socket
select
WSAAsyncSelect
WSAAsyncGetHostByName
sendto
send
recvfrom
recv
connect
closesocket
bind
htons
htonl
accept
WSASetLastError
WSAGetLastError
WSAStartup
Sections
.text Size: 76KB - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 8KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.aspack Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE