Static task
static1
Behavioral task
behavioral1
Sample
5ec1502a4e3da6a35722ba7ba44787d2_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5ec1502a4e3da6a35722ba7ba44787d2_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5ec1502a4e3da6a35722ba7ba44787d2_JaffaCakes118
-
Size
1.4MB
-
MD5
5ec1502a4e3da6a35722ba7ba44787d2
-
SHA1
55f21487ac61b329795b27fb6ace1f036e56862a
-
SHA256
d56ed2182923ebe1003050fb2b7c9839123088e06a160faf3ea479a9b55ae933
-
SHA512
9dce9238785287cce9ab41fdb4c5fe59f16c42752cb21d22da09730db26fd0bd2824febf3054786ad55ebb2ca20f1326a48cb095c21d511e7b68728934c313f2
-
SSDEEP
24576:DPefZHsruCcxbGlttblwrY3F4EzJo/faY46ipjfaE8Rbh67l2rB:rCispGlttbiY3F5zq/fH47BaE8Rbh9rB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5ec1502a4e3da6a35722ba7ba44787d2_JaffaCakes118
Files
-
5ec1502a4e3da6a35722ba7ba44787d2_JaffaCakes118.exe windows:4 windows x86 arch:x86
feb550f3d400b209ab8579acc153821a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetLastError
CreateProcessA
ReadConsoleA
FindAtomA
GetFileTime
DeleteAtom
OpenFileMappingA
ReadFile
CreateThread
GetConsoleMode
SetLastError
CopyFileW
GetFileSize
ExitThread
GetCommandLineA
CopyFileExA
GetComputerNameA
CopyFileA
comctl32
ImageList_AddMasked
ImageList_Create
ImageList_AddIcon
ImageList_GetImageRect
ImageList_Copy
ImageList_GetIconSize
ImageList_Merge
ImageList_DragShowNolock
ImageList_LoadImageW
InitCommonControls
ImageList_GetIcon
ImageList_DragLeave
ImageList_GetImageCount
ImageList_DragMove
ImageList_Remove
ImageList_EndDrag
ImageList_Destroy
ImageList_DrawEx
ImageList_LoadImageA
ImageList_Replace
ImageList_Draw
ImageList_ReplaceIcon
ImageList_Read
ImageList_Merge
ImageList_Copy
ImageList_DrawIndirect
ImageList_Remove
ImageList_LoadImageW
ImageList_LoadImageA
ImageList_DrawEx
ImageList_GetDragImage
ImageList_DragMove
ImageList_Read
ImageList_GetImageRect
ImageList_DragLeave
ImageList_Create
ImageList_EndDrag
ImageList_BeginDrag
advapi32
RegQueryInfoKeyA
RegCreateKeyExA
RegEnumKeyA
RegDeleteValueA
RegQueryValueExA
RegReplaceKeyW
RegGetKeySecurity
RegOpenKeyExW
RegCreateKeyExW
RegQueryValueW
RegReplaceKeyA
RegDeleteValueW
RegDeleteKeyW
RegOpenKeyW
RegEnumValueW
RegLoadKeyW
RegEnumKeyW
RegEnumKeyExA
RegDeleteValueA
RegOpenKeyExW
RegGetKeySecurity
RegOpenKeyW
RegEnumKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegLoadKeyA
RegEnumValueW
RegDeleteKeyA
RegQueryValueW
RegQueryInfoKeyA
RegDeleteKeyW
RegQueryValueA
RegFlushKey
RegQueryValueExA
RegEnumKeyA
RegCreateKeyExA
RegReplaceKeyW
RegOpenKeyA
RegOpenKeyExA
RegLoadKeyW
Sections
.text Size: 196KB - Virtual size: 194KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1.2MB - Virtual size: 3.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 241B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ