Static task
static1
Behavioral task
behavioral1
Sample
732d13bed2aafbe4fa77a9ba7594a86a_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
732d13bed2aafbe4fa77a9ba7594a86a_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
732d13bed2aafbe4fa77a9ba7594a86a_JaffaCakes118
-
Size
252KB
-
MD5
732d13bed2aafbe4fa77a9ba7594a86a
-
SHA1
969e586424c6fdae8a521cbc846c910d668b9e35
-
SHA256
34607f2e7bc346d49bebffa43e89bfa7ada2f7c2d4865a0a8a600f1839a18c13
-
SHA512
51bad8f7559fd4ba6f2b27e2b1fe88e265ba7797aaa48582e42e8f00e51aaa0e2b6da64fa6fe7c74e3c7b22255efb92faaeff0cd4d614564a859d5c824e180dd
-
SSDEEP
6144:J1rwii7st1Y+S6pYQCR+gs74dVGwG+oISthMZzLkV:JT+sH4wgsLMFkV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 732d13bed2aafbe4fa77a9ba7594a86a_JaffaCakes118
Files
-
732d13bed2aafbe4fa77a9ba7594a86a_JaffaCakes118.exe windows:4 windows x86 arch:x86
729e2b8cebe03557fa750328914aa7f2
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
ws2_32
WSACleanup
inet_ntoa
gethostbyname
gethostname
WSAStartup
kernel32
GetProcessHeap
RaiseException
CreateMutexW
CreateDirectoryW
RemoveDirectoryW
SetErrorMode
GetExitCodeThread
MoveFileW
GetSystemTime
GetCurrentThreadId
IsDebuggerPresent
SetUnhandledExceptionFilter
GetSystemDirectoryW
FileTimeToSystemTime
GlobalAlloc
lstrlenW
lstrcmpiW
DosDateTimeToFileTime
ExpandEnvironmentStringsA
WaitForSingleObject
CreateEventW
LoadResource
FindResourceW
FreeLibrary
LocalFree
lstrlenA
OpenEventW
SystemTimeToFileTime
GetLocalTime
GetModuleHandleW
GetTempPathW
lstrcmpW
GetProcAddress
user32
GetForegroundWindow
MessageBoxW
advapi32
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
AdjustTokenPrivileges
LookupPrivilegeValueW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
CreateProcessAsUserW
SetSecurityInfo
SetEntriesInAclW
BuildExplicitAccessWithNameW
GetSecurityDescriptorDacl
GetSecurityInfo
DuplicateTokenEx
RegQueryValueExA
RegOpenKeyExA
DeregisterEventSource
ReportEventW
RegisterEventSourceW
GetTokenInformation
OpenProcessToken
ControlService
QueryServiceStatus
CloseServiceHandle
OpenServiceW
OpenSCManagerW
StartServiceW
QueryServiceConfigW
ImpersonateLoggedOnUser
RevertToSelf
SetThreadToken
LookupAccountSidW
GetUserNameW
shell32
ShellExecuteW
shlwapi
PathGetDriveNumberW
quartz
AMGetErrorTextA
DllUnregisterServer
DBToAmpFactor
AMGetErrorTextW
DllRegisterServer
AmpFactorToDB
DllCanUnloadNow
dsauth
StoreSetSearchSubTree
StoreInitHandle
Sections
.text Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.o Size: 1KB - Virtual size: 69KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.NCfFn Size: 5KB - Virtual size: 558KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.HFHP Size: 81KB - Virtual size: 169KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.G Size: 1KB - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ReMw Size: 2KB - Virtual size: 122KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 6KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.BmRgDG Size: 135KB - Virtual size: 196KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ