Static task
static1
Behavioral task
behavioral1
Sample
6f0ce12148d37e7ad1cda54c9590edce_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
6f0ce12148d37e7ad1cda54c9590edce_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
6f0ce12148d37e7ad1cda54c9590edce_JaffaCakes118
-
Size
1.4MB
-
MD5
6f0ce12148d37e7ad1cda54c9590edce
-
SHA1
e66ca11ac7328878f699bddc0b27b84c736cd41a
-
SHA256
31fcd665fb653d29fcb22dd1a8d1f5d888f9ee4eac4578d509f772b517f4d386
-
SHA512
1f8a77649c493f87d2c95204e84725f27467341145b4c5184b83cd1e3f1d00262f5b60c475ab5fb98f9d487ac23f935665c6287afcf10f36cf73181ec2d3e3a8
-
SSDEEP
24576:P3jmcq3wvLlcTxaXeUGeMFWmyhMhaAzuVGMOxvDUZEF2iFX/HEIOkk:a3wvLl0HUGeMcmQMhHvVUZu2Oknkk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6f0ce12148d37e7ad1cda54c9590edce_JaffaCakes118
Files
-
6f0ce12148d37e7ad1cda54c9590edce_JaffaCakes118.exe windows:5 windows x86 arch:x86
8c38ff174a2d83595b983b18e19e2841
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrlenA
lstrcpynW
FlushInstructionCache
GetCurrentProcess
LockResource
LoadResource
FindResourceW
FreeLibrary
MultiByteToWideChar
SizeofResource
LoadLibraryExW
GetModuleFileNameW
GetCommandLineW
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetTimeZoneInformation
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
lstrcpynA
GetTimeFormatA
InterlockedExchange
InitializeCriticalSectionAndSpinCount
WideCharToMultiByte
InterlockedIncrement
GetLocaleInfoW
SetConsoleCtrlHandler
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetStartupInfoA
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
ExitProcess
Sleep
HeapSize
HeapReAlloc
FatalAppExitA
GetVersionExW
lstrcmpiW
GetDateFormatA
InterlockedDecrement
HeapDestroy
HeapCreate
GetModuleFileNameA
GetStdHandle
WriteFile
GetCurrentThread
SetLastError
TlsSetValue
TlsAlloc
TlsGetValue
GetLastError
lstrlenW
GetModuleHandleW
LoadLibraryW
GetProcAddress
GetCurrentThreadId
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetLocaleInfoA
RaiseException
InterlockedCompareExchange
HeapFree
GetProcessHeap
HeapAlloc
LoadLibraryA
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStartupInfoW
TlsFree
user32
SetMenuDefaultItem
DefWindowProcW
CharNextW
DestroyWindow
TranslateAcceleratorW
GetWindowRect
InvalidateRect
CreateWindowExW
PeekMessageW
PtInRect
IsWindow
MessageBeep
IsWindowVisible
ShowWindow
TrackPopupMenuEx
SetWindowPos
CallWindowProcW
LoadStringA
PostQuitMessage
SetFocus
LoadStringW
UnregisterClassA
SetMenuItemInfoW
MapWindowPoints
GetClientRect
PostMessageW
SetWindowLongW
MonitorFromPoint
GetMonitorInfoW
GetMenuItemInfoW
RemoveMenu
GetMenuItemCount
AppendMenuW
DestroyMenu
CreatePopupMenu
GetWindowLongW
SendMessageW
gdi32
GetObjectW
GetStockObject
DeleteObject
ole32
CoTaskMemRealloc
CoCreateInstance
CoTaskMemFree
CoUninitialize
CoInitialize
CoTaskMemAlloc
oleaut32
VarUI4FromStr
SysFreeString
advapi32
RegSetValueExW
RegDeleteValueW
RegEnumKeyExW
RegQueryInfoKeyW
RegDeleteKeyW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
comctl32
InitCommonControlsEx
ImageList_LoadImageW
Sections
.text Size: 130KB - Virtual size: 130KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ