Static task
static1
Behavioral task
behavioral1
Sample
5e48ab2f8c471c549f1d883b1e35f2ac_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5e48ab2f8c471c549f1d883b1e35f2ac_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5e48ab2f8c471c549f1d883b1e35f2ac_JaffaCakes118
-
Size
336KB
-
MD5
5e48ab2f8c471c549f1d883b1e35f2ac
-
SHA1
be0e2bc611c11e05b7aa4cb394691b606081b45b
-
SHA256
39771062b6c9bcd89b7e3f45f10f01f5e80426c90ed5bf7a8a79939e9f82dcad
-
SHA512
bad6f36a947449d60d6e707b944603ec89bd3ea9518ca23d72e879c1cfada0a00b9840253913b0ef4d4d8c2dc6452f361e6e201c4f021b61b0e71622b69e975d
-
SSDEEP
6144:YJp7o2RUIgCPBE9z7oOg67/oKeWfGXxcGgudxv9J46TgfZAs:YJp7o2RUIgSEh7oUUW+6GgiRgvfJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5e48ab2f8c471c549f1d883b1e35f2ac_JaffaCakes118
Files
-
5e48ab2f8c471c549f1d883b1e35f2ac_JaffaCakes118.exe windows:4 windows x86 arch:x86
c4e09d9d5d700762223ece7390a950e4
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateFileW
GetACP
MultiByteToWideChar
lstrlenW
GetLastError
EnterCriticalSection
LockResource
DeleteCriticalSection
CloseHandle
LocalFree
GetFileSize
SetErrorMode
CreateProcessW
GetVolumeInformationA
CreateProcessA
ReadFile
GetSystemDirectoryA
GetTempFileNameA
LeaveCriticalSection
GetModuleFileNameA
Process32NextW
CreateToolhelp32Snapshot
GetFileTime
GetVersionExA
GetWindowsDirectoryW
GetTempPathA
SetEvent
TerminateThread
GetExitCodeThread
CreateEventW
CreateThread
GetModuleFileNameW
WaitForMultipleObjects
SetFilePointer
FlushFileBuffers
GetConsoleMode
FormatMessageW
SizeofResource
Sleep
WideCharToMultiByte
InitializeCriticalSection
WriteFile
GetProcessHeap
GetTickCount
WaitForSingleObject
HeapFree
HeapAlloc
LoadResource
FindResourceW
FindResourceExW
lstrlenA
Process32FirstW
HeapReAlloc
SetEndOfFile
SetEnvironmentVariableW
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetConsoleCP
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
CreateFileA
GetExitCodeProcess
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
LoadLibraryA
InterlockedExchange
GetLocaleInfoA
GetThreadLocale
RaiseException
HeapDestroy
HeapSize
InterlockedIncrement
InterlockedDecrement
VirtualProtect
VirtualAlloc
GetProcAddress
GetModuleHandleA
GetSystemInfo
VirtualQuery
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
DeleteFileW
GetLocalTime
ExitProcess
GetCommandLineA
GetStartupInfoA
RtlUnwind
GetCPInfo
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
HeapCreate
VirtualFree
GetStdHandle
GetFileAttributesW
SetHandleCount
GetFileType
user32
GetKeyboardState
GetActiveWindow
UnregisterClassA
advapi32
QueryServiceStatusEx
StartServiceW
ChangeServiceConfig2W
OpenSCManagerW
CloseServiceHandle
CreateServiceW
RegisterServiceCtrlHandlerW
SetServiceStatus
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
StartServiceCtrlDispatcherW
ole32
CLSIDFromProgID
CoInitialize
CoUninitialize
CoCreateInstance
StringFromCLSID
ws2_32
WSACloseEvent
WSASetEvent
WSAStartup
getaddrinfo
WSARecv
WSASocketW
WSASend
WSAGetLastError
WSAEnumNetworkEvents
WSAEventSelect
WSACleanup
WSAGetOverlappedResult
freeaddrinfo
WSACreateEvent
WSASetLastError
closesocket
WSAResetEvent
WSAConnect
Sections
.text Size: 284KB - Virtual size: 283KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 36KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ