Static task
static1
Behavioral task
behavioral1
Sample
5f72cde073618b46f2b2f738e8cbdfdc_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
5f72cde073618b46f2b2f738e8cbdfdc_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5f72cde073618b46f2b2f738e8cbdfdc_JaffaCakes118
-
Size
342KB
-
MD5
5f72cde073618b46f2b2f738e8cbdfdc
-
SHA1
8d13088c112110440de137d68aab81f88208ca85
-
SHA256
b8e04d574407b5e19ff48b295ff2968c8e32381ccc8c34ac6edb2ddd6b315164
-
SHA512
7bc870063c04251d67d253147c59afbfa6a01b1dc090b39016d80b5cdd947cb4404368c5e3147d1e66d4b1fdac1b24f5c392cdd91a7bf52aa9be71cee55b25a7
-
SSDEEP
6144:6Tvzzv30A0iUtPMIvnDpgXiiEyOvFnuPKOCNpUG403iVTw2trrmekQFnk:mH3v0iUDnDpgSiEVdnu9CwUgVyK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5f72cde073618b46f2b2f738e8cbdfdc_JaffaCakes118
Files
-
5f72cde073618b46f2b2f738e8cbdfdc_JaffaCakes118.exe windows:5 windows x86 arch:x86
7fb2c7efe5b5ca95d73455ebd2101814
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
_wtoi
wcslen
wcscat
_wcsnicmp
wcsstr
free
_initterm
malloc
_adjust_fdiv
kernel32
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapAlloc
GetProcessHeap
HeapFree
DeleteCriticalSection
CloseHandle
ExpandEnvironmentStringsW
WaitForSingleObject
GetSystemTimeAsFileTime
lstrlenW
GetProcAddress
LoadLibraryW
SwitchToThread
InterlockedExchange
QueueUserAPC
DisableThreadLibraryCalls
GetLastError
LoadLibraryExW
FreeLibrary
CompareStringW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
netsh.exe
MatchTagsInCmdLine
MatchEnumTag
PrintMessageFromModule
RegisterContext
RegisterHelper
ole32
CoInitializeEx
CoTaskMemFree
CoCreateInstance
CoSetProxyBlanket
CoTaskMemAlloc
StringFromGUID2
CoUninitialize
oleaut32
VariantInit
SysAllocString
VariantClear
SysFreeString
rpcrt4
RpcStringFreeW
RpcStringBindingComposeW
NdrClientCall2
RpcBindingFromStringBindingW
RpcBindingSetAuthInfoExW
RpcBindingFree
rtutils
TraceRegisterExA
TraceDeregisterW
TraceVprintfExA
user32
LoadStringW
Sections
.text Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.p102 Size: 512B - Virtual size: 186B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.0x9a9 Size: 512B - Virtual size: 186B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.kalqo Size: 512B - Virtual size: 186B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.88111 Size: 512B - Virtual size: 186B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.9102 Size: 512B - Virtual size: 392B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.1827 Size: 512B - Virtual size: 186B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.7382 Size: 512B - Virtual size: 186B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.81721 Size: 148KB - Virtual size: 147KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ajdiw Size: 512B - Virtual size: 194B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.09a Size: 512B - Virtual size: 208B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.09a5 Size: 512B - Virtual size: 216B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.09a6 Size: 512B - Virtual size: 186B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.11524 Size: 512B - Virtual size: 158B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.9a9s Size: 148KB - Virtual size: 147KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.a4a4 Size: 512B - Virtual size: 158B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.afa4 Size: 512B - Virtual size: 184B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 284KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ