Static task
static1
Behavioral task
behavioral1
Sample
5fa114b05b89e19f8e9cc929c20f2ae5_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5fa114b05b89e19f8e9cc929c20f2ae5_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5fa114b05b89e19f8e9cc929c20f2ae5_JaffaCakes118
-
Size
237KB
-
MD5
5fa114b05b89e19f8e9cc929c20f2ae5
-
SHA1
081f7d158eb2248fa79d2bf68f54dada37e71386
-
SHA256
46dcdbadc3deb461b28ed291385aef46e97e8868fcb88bf6f07130b419a94b6b
-
SHA512
78c7b1c4765a0293aee89f4b23f862ee6ef61be1e9149ffa0c17e3949804f832eea7129cd4266b707d566778f97046694b1c2ce3b33d836d45831e84dfa4fae2
-
SSDEEP
1536:MU5cLTg4j8JcqnQAVZDIMpJ5VFzhJc+ztaNJDhjTsI1eXRXb4Nkamr5gWb7diJqQ:/QMpZJXqN91eXRLzamr5gWb7dAxduQP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5fa114b05b89e19f8e9cc929c20f2ae5_JaffaCakes118
Files
-
5fa114b05b89e19f8e9cc929c20f2ae5_JaffaCakes118.exe windows:5 windows x86 arch:x86
40ed4ca5a8f2c4415daf6f1621cea15b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetTickCount
GetProcessHeap
SetEndOfFile
CreateFileA
CreateFileW
CopyFileA
LoadLibraryA
CompareStringW
CompareStringA
SetStdHandle
WriteConsoleW
GetModuleFileNameA
Sleep
FindFirstFileA
FindNextFileA
FindClose
GetFileAttributesA
SetFileAttributesA
AllocConsole
GetCurrentThread
GetLastError
GetCurrentProcess
LocalAlloc
LocalFree
CloseHandle
GetLocaleInfoW
GetDriveTypeA
InterlockedIncrement
InterlockedDecrement
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
DeleteFileA
SetEnvironmentVariableA
GetCurrentDirectoryA
SetCurrentDirectoryA
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
HeapFree
GetCommandLineA
GetStartupInfoA
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
GetCPInfo
HeapAlloc
GetTimeZoneInformation
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
SetHandleCount
GetStdHandle
GetFileType
WriteFile
GetConsoleCP
GetConsoleMode
FlushFileBuffers
ReadFile
SetFilePointer
ExitProcess
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
HeapSize
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
InitializeCriticalSectionAndSpinCount
WriteConsoleA
GetConsoleOutputCP
GetFullPathNameA
user32
GetLastInputInfo
EnumWindows
GetClassNameA
SetForegroundWindow
GetForegroundWindow
GetWindowTextA
VkKeyScanA
keybd_event
FindWindowA
ShowWindow
advapi32
OpenThreadToken
OpenProcessToken
DuplicateToken
AllocateAndInitializeSid
InitializeSecurityDescriptor
GetLengthSid
InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
IsValidSecurityDescriptor
AccessCheck
FreeSid
RegSetValueA
Sections
.text Size: 108KB - Virtual size: 107KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 18KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 83KB - Virtual size: 82KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ