Static task
static1
Behavioral task
behavioral1
Sample
5d610acd7c10c57fc3dd523f93b6eaf2_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
5d610acd7c10c57fc3dd523f93b6eaf2_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5d610acd7c10c57fc3dd523f93b6eaf2_JaffaCakes118
-
Size
24KB
-
MD5
5d610acd7c10c57fc3dd523f93b6eaf2
-
SHA1
9cb2909d5c0f7979166537602536c02dd6f6c1fa
-
SHA256
f2345944f45e302d34e7d5320846d62a3e64a05d8f79a21dad751aae4a95318c
-
SHA512
f646d1287c3c62f4ab9db86f2d997134c12cf6675338835f2b3cfc1e4963e1a35f5276159df8c790b6559485396205e493ee730f335a3e28c83a6a7c260ba05f
-
SSDEEP
384:PHkd5D6q79Dt0mMIhNYGL2pxwgEIxqZ4l2MK:PoSIPJ2XU2qnZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5d610acd7c10c57fc3dd523f93b6eaf2_JaffaCakes118
Files
-
5d610acd7c10c57fc3dd523f93b6eaf2_JaffaCakes118.exe windows:4 windows x86 arch:x86
f150c96cf1e84d22f103af187002364c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetThreadPriority
CreateThread
OpenProcess
OpenEventA
GetCurrentThread
GetStartupInfoA
ExitProcess
GetCommandLineA
GetModuleHandleA
HeapAlloc
GetProcessHeap
HeapFree
lstrlenA
lstrcatA
lstrcpyA
GetVersionExA
WaitForSingleObject
WaitForMultipleObjects
CreateDirectoryA
SetLastError
GetSystemDirectoryA
SetCurrentDirectoryA
GetCurrentDirectoryA
GetFileAttributesA
GetDriveTypeA
lstrcpynA
OpenMutexA
MapViewOfFile
OpenFileMappingA
ResetEvent
ReleaseMutex
CreateEventA
UnmapViewOfFile
lstrcmpiA
WritePrivateProfileStringA
lstrcmpA
SetEvent
WriteFile
MultiByteToWideChar
CreateFileA
CloseHandle
GetLastError
DeleteFileA
user32
GetKeyboardType
DispatchMessageA
TranslateMessage
PeekMessageA
MsgWaitForMultipleObjects
DdeNameService
DdeQueryStringA
DdeCmpStringHandles
EnumWindows
CharNextA
GetClassNameA
DdeAccessData
DdeUnaccessData
DdeFreeDataHandle
DdeFreeStringHandle
DdeCreateStringHandleA
DdeUninitialize
DdeInitializeA
wsprintfA
DdeConnect
DdeClientTransaction
PostMessageA
DdeDisconnect
advapi32
RegCloseKey
RegOpenKeyExA
RegSetValueExA
RegDeleteValueA
RegCreateKeyExA
RegQueryValueExA
ole32
CoCreateInstance
CoInitialize
CoUninitialize
CLSIDFromProgID
oleaut32
VariantClear
VariantInit
SysAllocStringLen
SysFreeString
Sections
.text Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 448B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE