Static task
static1
Behavioral task
behavioral1
Sample
631f3b27f990d69a717d8aa2db566c96_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
631f3b27f990d69a717d8aa2db566c96_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
631f3b27f990d69a717d8aa2db566c96_JaffaCakes118
-
Size
458KB
-
MD5
631f3b27f990d69a717d8aa2db566c96
-
SHA1
a176644b28c9ba17f4f81b11cf29fca8a832a4ac
-
SHA256
9f51cfe625089e8477273903b1b4efdd0814af87ff3dded4decd7ea9ae52ee3f
-
SHA512
4d482f8cfb3c2d190519c23055281834c4a7ca0d20f4f7755927b20292af800bdcd4f5df9d819f2e0339635d460901a0f4f221a543406a77bc3bf82cdb55d02b
-
SSDEEP
12288:4d6EhMdtDeLmUvjmU59GbVyFvb4IirCmd:4dpgDjUz59GbVEja
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 631f3b27f990d69a717d8aa2db566c96_JaffaCakes118
Files
-
631f3b27f990d69a717d8aa2db566c96_JaffaCakes118.exe windows:5 windows x86 arch:x86
cbb71fcab3dec570b56b61786c0d44b4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
GetModuleFileNameA
GetFileAttributesA
WritePrivateProfileSectionA
DeleteFileA
ReadFile
SetFileAttributesA
FormatMessageA
GetLastError
CopyFileA
GetPrivateProfileSectionA
CreateDirectoryA
GetSystemInfo
GetShortPathNameA
WriteFile
GetExitCodeProcess
CreateProcessA
_llseek
_lwrite
_lread
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GetFileInformationByHandle
GetTickCount
_lclose
GlobalUnlock
GlobalLock
SetLastError
GlobalFree
MoveFileA
GetTempPathA
GetTempFileNameA
FreeResource
LockResource
LoadResource
SizeofResource
FindResourceExA
EnumResourceLanguagesA
EnumResourceNamesA
FreeLibrary
EnumResourceTypesA
LoadLibraryExA
GlobalAlloc
GetCurrentDirectoryA
GetSystemTime
MultiByteToWideChar
WideCharToMultiByte
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoA
GetPrivateProfileIntA
HeapFree
lstrcpynA
ExitProcess
GetProcAddress
GetModuleHandleA
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
HeapDestroy
HeapCreate
VirtualFree
LCMapStringA
LCMapStringW
GetACP
GetOEMCP
GetCPInfo
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
LoadLibraryA
InitializeCriticalSection
RtlUnwind
InterlockedExchange
VirtualQuery
SetFilePointer
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
VirtualProtect
SetStdHandle
FlushFileBuffers
GetFullPathNameA
lstrcmpiA
LocalAlloc
lstrcatA
lstrlenA
lstrcpyA
IsDBCSLeadByte
FindFirstFileA
FindClose
GetPrivateProfileStringA
lstrcmpA
HeapAlloc
WritePrivateProfileStringA
CreateFileA
CloseHandle
GetCommandLineA
LocalFree
gdi32
GetStockObject
DeleteObject
GetDeviceCaps
GetObjectA
CreateFontIndirectA
user32
LoadStringA
SendMessageA
ReleaseDC
GetDC
CharNextA
SendDlgItemMessageA
GetSystemMetrics
MessageBoxA
MessageBeep
wsprintfA
SetFocus
PostMessageA
SetDlgItemTextA
GetDlgItemTextA
IsDlgButtonChecked
CheckDlgButton
ShowWindow
GetWindowRect
CheckRadioButton
MsgWaitForMultipleObjects
DispatchMessageA
PeekMessageA
GetParent
SetWindowLongA
GetWindowLongA
CallWindowProcA
EnableWindow
GetDlgItem
CharPrevA
comdlg32
GetOpenFileNameA
GetSaveFileNameA
version
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA
advapi32
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
Sections
.text Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.9e3c Size: 203KB - Virtual size: 203KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.1o2p Size: 203KB - Virtual size: 203KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.16as Size: 512B - Virtual size: 216B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.aeas Size: 512B - Virtual size: 216B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.k1kl Size: 512B - Virtual size: 216B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ps1i Size: 512B - Virtual size: 216B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.t3ta Size: 512B - Virtual size: 216B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ksi1 Size: 512B - Virtual size: 216B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.12i1 Size: 512B - Virtual size: 216B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.123f Size: 512B - Virtual size: 216B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.eaa Size: 512B - Virtual size: 216B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ze Size: 512B - Virtual size: 216B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.1teaX Size: 512B - Virtual size: 216B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.134 Size: 512B - Virtual size: 216B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.724 Size: 512B - Virtual size: 216B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.182 Size: 512B - Virtual size: 216B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.381 Size: 512B - Virtual size: 216B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.832 Size: 512B - Virtual size: 216B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ii32 Size: 512B - Virtual size: 216B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.i832 Size: 512B - Virtual size: 216B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.i833 Size: 512B - Virtual size: 222B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.i803 Size: 512B - Virtual size: 222B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.i804 Size: 512B - Virtual size: 222B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 312B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ