Static task
static1
Behavioral task
behavioral1
Sample
688d36e5db29cb5a02da169a2630cad3_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
688d36e5db29cb5a02da169a2630cad3_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
688d36e5db29cb5a02da169a2630cad3_JaffaCakes118
-
Size
220KB
-
MD5
688d36e5db29cb5a02da169a2630cad3
-
SHA1
19a50b59096ebd7a4e1ce2b51029c141e4b34614
-
SHA256
56b6c0615f58b2dc944b19baf9dde7a2d49103a20ff2691fb9604067c823911d
-
SHA512
a32b69144fa174ecaf4ee70e34ef7c116b4a0b09234e17625b55059ac8a36db0be8fd8e0c5b9f5c5bf77c3b30650d012a59f4a590e06c00017986633c03cb7e7
-
SSDEEP
3072:4jTgI6Fo2/CX9DNJN5HcUvD4zWqzNgT+utTBf8yV70tR:CgI6FzCXlDHpvDOWNT+utTBL+R
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 688d36e5db29cb5a02da169a2630cad3_JaffaCakes118
Files
-
688d36e5db29cb5a02da169a2630cad3_JaffaCakes118.exe windows:4 windows x86 arch:x86
55bbff53d8ab81c9b7148b18b98d98f2
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ReadFile
CreateFileA
GetTempPathA
GetProcAddress
LoadLibraryA
GetSystemDirectoryA
GetWindowsDirectoryA
FindClose
FindFirstFileA
CreateEventA
TerminateThread
WaitForSingleObject
DeleteFileA
CreateThread
WriteFile
ResetEvent
WaitForMultipleObjects
SetFilePointer
GetShortPathNameA
OpenProcess
CreateDirectoryA
GetFileSize
GetTickCount
SetFileAttributesA
GetFileAttributesA
SetEvent
CloseHandle
MultiByteToWideChar
GetCommandLineA
OpenEventA
GetCommandLineW
IsValidCodePage
HeapLock
PulseEvent
GetModuleFileNameA
Sleep
GetStartupInfoA
GetModuleHandleA
GlobalAlloc
GlobalFree
GetQueuedCompletionStatus
PostQueuedCompletionStatus
CreateIoCompletionPort
HeapWalk
HeapUnlock
HeapFree
HeapAlloc
HeapDestroy
HeapCreate
GetExitCodeProcess
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetExitCodeThread
FindNextFileA
GetCurrentProcessId
GetLongPathNameA
GetCurrentProcess
GetVolumeInformationA
GetDriveTypeA
CreateProcessA
DuplicateHandle
CreatePipe
user32
GetWindow
GetWindowThreadProcessId
GetDesktopWindow
GetWindowTextA
GetMessageA
PostThreadMessageA
ExitWindowsEx
PostMessageA
GetWindowLongA
GetSystemMetrics
DestroyWindow
SendMessageA
IsWindow
DestroyCursor
CopyImage
EnumWindows
AppendMenuA
CloseDesktop
FindWindowA
gdi32
ArcTo
FlattenPath
EndDoc
GetDIBits
GetObjectA
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
CreateDCA
CancelDC
shell32
SHFileOperationA
ShellExecuteA
DuplicateIcon
gdiplus
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipDisposeImage
GdipSaveImageToFile
GdipFree
GdipAlloc
GdipCloneImage
GdiplusShutdown
GdiplusStartup
GdipLoadImageFromFile
mfc42
ord1601
ord537
ord3571
ord3663
ord3626
ord2414
ord665
ord1979
ord5186
ord354
ord5785
ord1641
ord1640
ord323
ord800
ord640
msvcrt
rand
_ftol
_purecall
malloc
pow
free
wcscmp
_strupr
_strset
??1type_info@@UAE@XZ
_exit
srand
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
__dllonexit
_onexit
_controlfp
memcmp
strchr
memcpy
strlen
strrchr
_CxxThrowException
memset
strcpy
strstr
strcmp
__CxxFrameHandler
sprintf
_XcptFilter
ws2_32
WSAStartup
gethostbyname
gethostname
closesocket
shutdown
WSAIoctl
socket
bind
htons
sendto
ntohs
WSAGetLastError
recvfrom
getsockname
recv
send
connect
WSACleanup
Sections
.text Size: 172KB - Virtual size: 168KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 28KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ