Static task
static1
Behavioral task
behavioral1
Sample
68da72e73ab76e0b70924575a915ba63_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
68da72e73ab76e0b70924575a915ba63_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
68da72e73ab76e0b70924575a915ba63_JaffaCakes118
-
Size
279KB
-
MD5
68da72e73ab76e0b70924575a915ba63
-
SHA1
bcf6a9e47b06ddf1c6a73cb84f5dc57c7b8b46d0
-
SHA256
5a38a1b978ea7a35b9221b0c2a8e812c2824992c08948c047ff5355b270fe3d1
-
SHA512
7c8e787e8d327a15be1f9332dbc82a50a450fbb733c65da0311f4cad75c9d0eb42e5eab67b15c059ce12a9d6b7d9f9eef60bedfe9ea262212ea5b8ae91de74ce
-
SSDEEP
6144:xWzxmiJSDeQt4Xa7ZYfdklJOtCUqvPYLPfCwZhC2P3KB2Ts:xWzYKSKQ++WalJOd8sfC2hn3m2Ts
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 68da72e73ab76e0b70924575a915ba63_JaffaCakes118
Files
-
68da72e73ab76e0b70924575a915ba63_JaffaCakes118.exe windows:4 windows x86 arch:x86
c81237f706047392a82af362900b5340
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
AdjustTokenPrivileges
ControlService
DeleteService
EqualSid
InitializeSecurityDescriptor
QueryServiceConfig2A
RegQueryInfoKeyA
StartServiceA
StartServiceCtrlDispatcherA
UnlockServiceDatabase
kernel32
ContinueDebugEvent
CreateFileA
CreateFileMappingA
CreateThread
CreateToolhelp32Snapshot
DeleteCriticalSection
DeleteFileA
DisableThreadLibraryCalls
DuplicateHandle
EnterCriticalSection
ExitProcess
ExitThread
FileTimeToLocalFileTime
FlushFileBuffers
FormatMessageA
FreeLibrary
GetCPInfo
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDateFormatA
GetDriveTypeA
GetLastError
GetLocalTime
GetModuleHandleA
GetPrivateProfileSectionA
GetProcAddress
GetProcessHeap
GetStdHandle
GetSystemTimeAsFileTime
GetThreadLocale
GetTickCount
GetTimeZoneInformation
GetUserDefaultLCID
GetVersionExA
GetWindowsDirectoryA
GlobalAlloc
GlobalFree
GlobalHandle
HeapDestroy
HeapFree
InitializeCriticalSection
InterlockedCompareExchange
IsBadCodePtr
IsValidLocale
LCMapStringA
LeaveCriticalSection
LoadLibraryA
LoadResource
LockResource
MoveFileA
MoveFileExA
MultiByteToWideChar
OpenProcess
OutputDebugStringA
QueryPerformanceCounter
RaiseException
ReleaseMutex
SetCurrentDirectoryA
SetEndOfFile
SetEnvironmentVariableA
SetEvent
SetFileTime
SetLastError
SetThreadPriority
SizeofResource
Sleep
SuspendThread
SystemTimeToFileTime
TlsSetValue
UnhandledExceptionFilter
VirtualFree
WideCharToMultiByte
WriteConsoleA
WritePrivateProfileStringA
lstrcmpiA
lstrcpyA
user32
CharNextA
CharPrevA
CharUpperA
CheckRadioButton
CreateWindowExA
DefWindowProcA
DestroyMenu
DispatchMessageA
ExitWindowsEx
FillRect
GetAsyncKeyState
GetDlgItem
GetMessagePos
GetWindow
GetWindowTextA
InflateRect
IsWindowEnabled
LoadIconA
MessageBoxA
PtInRect
RegisterClassA
SendMessageA
SetCursor
SetFocus
SetForegroundWindow
SetMenu
SetWindowLongA
SetWindowTextA
WinHelpA
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
Sections
.text Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.bss Size: 231KB - Virtual size: 2.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 15KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
rtvvk Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
wgerv Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ