Static task
static1
Behavioral task
behavioral1
Sample
5ec6093381a7d00f770425ce0d4e195d_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5ec6093381a7d00f770425ce0d4e195d_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5ec6093381a7d00f770425ce0d4e195d_JaffaCakes118
-
Size
596KB
-
MD5
5ec6093381a7d00f770425ce0d4e195d
-
SHA1
7b5a268585c23fa760063644ac91be43db5a43cb
-
SHA256
4252da1640ae18e2f5dd941226bfe3c129c1a2bc97e700042f19359a905a8672
-
SHA512
1124c9f4a944623bff09c8b94dab7c32cd0f8b7f421b089a209094657b82978b91f2d2c1cdeb8781ba91f86dbdcdcb8c84c396c25ef059274265257f8c4d5863
-
SSDEEP
12288:czu6z5r0AbxE40jLbjBZn18aj9pBtCnDjDQlxqEsEc+ZfwC1XKg4Zqa/qay:CJzND6TjLbNZhjtAjQlPtc+Zf7XKgnay
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5ec6093381a7d00f770425ce0d4e195d_JaffaCakes118
Files
-
5ec6093381a7d00f770425ce0d4e195d_JaffaCakes118.exe windows:5 windows x86 arch:x86
475ad812753a1cf764636c00784e392c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
ReadFile
GetModuleHandleA
RaiseException
GetCurrentThread
InterlockedCompareExchange
GetCommandLineA
WideCharToMultiByte
GetCommandLineW
GetCurrentProcessId
GetEnvironmentStrings
lstrlenW
VirtualQuery
GetThreadLocale
LCMapStringA
lstrlenA
GetSystemInfo
HeapCreate
LCMapStringW
LeaveCriticalSection
CreateFileA
GetFileType
CreateEventA
CreateFileW
GetTimeZoneInformation
FindNextFileA
CreateFileMappingA
CompareStringA
FindFirstFileA
GetProcessHeap
GlobalLock
CreateDirectoryA
GetFileSize
GetStartupInfoA
LoadLibraryA
FlushFileBuffers
GetTickCount
QueryPerformanceCounter
FreeLibrary
lstrcmpiA
SetHandleCount
EnterCriticalSection
HeapFree
InterlockedIncrement
GetCurrentThreadId
SetEndOfFile
GetConsoleMode
GlobalAlloc
TerminateProcess
SetEnvironmentVariableA
SetUnhandledExceptionFilter
SetFilePointer
GetACP
GetModuleFileNameA
GetVersionExA
ExitProcess
InterlockedDecrement
SetLastError
FormatMessageA
TlsGetValue
FindClose
InitializeCriticalSection
GetFullPathNameA
GetStringTypeW
HeapReAlloc
GetSystemTimeAsFileTime
WriteFile
GetStringTypeA
GetCPInfo
SetStdHandle
FreeEnvironmentStringsW
LoadLibraryExW
LocalAlloc
GetLocaleInfoA
GetCurrentProcess
DeleteCriticalSection
GetFileAttributesW
HeapDestroy
FindFirstFileW
LockResource
WaitForSingleObject
GetFileAttributesA
GetConsoleOutputCP
GetStdHandle
HeapAlloc
GetVersion
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStringsW
TlsSetValue
TlsAlloc
GetLastError
GetEnvironmentVariableA
RtlUnwind
GetOEMCP
GetProcAddress
GetModuleHandleW
CreateProcessA
UnmapViewOfFile
VirtualFree
Sleep
FindResourceA
MultiByteToWideChar
VirtualAlloc
ole32
OleUninitialize
OleInitialize
user32
MessageBoxA
MoveWindow
GetDesktopWindow
ScreenToClient
GetDlgItem
CheckMenuItem
SetWindowTextA
SetWindowLongA
GetSystemMetrics
MapWindowPoints
FillRect
GetWindowLongA
IsIconic
LoadStringA
TranslateMessage
PeekMessageA
EnableWindow
UpdateWindow
GetParent
SendMessageA
GetCursorPos
DispatchMessageA
SetWindowPos
PostQuitMessage
SystemParametersInfoA
InvalidateRect
GetClientRect
CallWindowProcA
GetSysColor
gdi32
CreateSolidBrush
CreateCompatibleDC
SetTextColor
DeleteDC
GetDeviceCaps
DeleteObject
SetBkMode
Sections
.text Size: 24KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 564KB - Virtual size: 560KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ