Static task
static1
Behavioral task
behavioral1
Sample
708b5c9020114efae2c12e034beda96e_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
708b5c9020114efae2c12e034beda96e_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
708b5c9020114efae2c12e034beda96e_JaffaCakes118
-
Size
238KB
-
MD5
708b5c9020114efae2c12e034beda96e
-
SHA1
5f627638fa1cd59f663b4374e326d5f6a527bb9f
-
SHA256
ce8aa9e48b90569de21a3c715042298e946ed788f5a808c368c1f01431587a97
-
SHA512
cf37b796369df6763c795a5c8d2f7f14944948d51463646a2d05319233c7dc8236d2c10c35c46a6a31aaad645f9dba2275ff57503847879cb329ebdb6a2af2d1
-
SSDEEP
6144:mRuhORg5xyqn2ApNN5CGHA8PBhf+Uh3iTh+lV:mo5YApxHA8PBhfgwV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 708b5c9020114efae2c12e034beda96e_JaffaCakes118
Files
-
708b5c9020114efae2c12e034beda96e_JaffaCakes118.exe windows:4 windows x86 arch:x86
1696b0b004fdea8365de92f969f82948
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CompareStringW
FreeLibrary
LoadLibraryExW
GetThreadLocale
SetThreadLocale
HeapReAlloc
HeapAlloc
HeapFree
GetProcessHeap
SetLastError
SetCurrentDirectoryW
CreateProcessW
GetPrivateProfileIntW
GetSystemTimeAsFileTime
FindCloseChangeNotification
CompareFileTime
WaitForSingleObject
SystemTimeToFileTime
GetLocalTime
FindFirstChangeNotificationW
GetTimeZoneInformation
GetCurrentThreadId
IsDebuggerPresent
SetUnhandledExceptionFilter
FileTimeToSystemTime
LeaveCriticalSection
EnterCriticalSection
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
lstrcmpiW
RaiseException
GetModuleHandleW
lstrlenW
DeleteCriticalSection
GetCurrentDirectoryW
CloseHandle
CreateEventW
UnhandledExceptionFilter
CreateThread
CreateFileW
GetFileSize
ReadFile
HeapSize
HeapDestroy
IsValidCodePage
VirtualAllocEx
user32
LoadStringW
CharNextW
advapi32
RegQueryValueExW
RegDeleteValueW
RegQueryInfoKeyW
OpenThreadToken
GetTokenInformation
RegCreateKeyExW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteKeyW
RegSetValueExW
RegCloseKey
shell32
SHGetFileInfoW
ole32
CoRevertToSelf
CoCreateInstance
StringFromCLSID
CoTaskMemFree
CoImpersonateClient
CoTaskMemRealloc
CoTaskMemAlloc
StringFromGUID2
oleaut32
SysFreeString
VarUI4FromStr
SysAllocString
VarBstrCmp
VariantCopy
SafeArrayLock
SafeArrayUnlock
SafeArrayCreate
SafeArrayRedim
SafeArrayDestroy
SafeArrayGetUBound
SafeArrayGetLBound
VariantClear
SysStringLen
LoadRegTypeLi
LoadTypeLi
VariantInit
RegisterTypeLi
UnRegisterTypeLi
SysAllocStringLen
VarBstrCat
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
esent
JetCreateInstance
odbccr32
SQLRowCount
SQLMoreResults
Sections
.text Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.O Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.nJ Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 212KB - Virtual size: 423KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.odmi Size: 1024B - Virtual size: 1001B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ