Static task
static1
Behavioral task
behavioral1
Sample
74473770463a75c7e0de6aeae366dd8f_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
74473770463a75c7e0de6aeae366dd8f_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
74473770463a75c7e0de6aeae366dd8f_JaffaCakes118
-
Size
260KB
-
MD5
74473770463a75c7e0de6aeae366dd8f
-
SHA1
1f35824827ca206a887ea7c9f9a1a688913001e3
-
SHA256
18a165db0c9d138266b8ca5623a3e8d57c9c710ba99f6ffd1f2826cc4cda40bb
-
SHA512
f33b0d2d65c470b6daf502d948d17bfd8c79667df6f8caea6a159985d90b857f43bfd1676ab311b274fb309b59bbe2a07b99703ec81a789ea254a6031760b456
-
SSDEEP
6144:wjEDyVUtKq9o8BC2N6tdTTTbfxXuzJwGhrBN+:bmVUtKq9o8BC2N6tdTTTbfxwmGhrD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 74473770463a75c7e0de6aeae366dd8f_JaffaCakes118
Files
-
74473770463a75c7e0de6aeae366dd8f_JaffaCakes118.exe windows:4 windows x86 arch:x86
5cf4000d34ef929fbb57e6cdc0c7afe0
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
DeleteFileA
ReleaseMutex
CreateProcessA
GetTempPathA
GetLastError
CreateMutexA
GetModuleFileNameA
CreateDirectoryA
RemoveDirectoryA
GetComputerNameA
WritePrivateProfileStringA
GetSystemTime
FileTimeToSystemTime
GetFileTime
Sleep
GetFileSize
WaitForSingleObject
GetLocalTime
GetDiskFreeSpaceA
SystemTimeToFileTime
CopyFileA
GetWindowsDirectoryA
DeviceIoControl
GetPrivateProfileStringA
GetVolumeInformationA
CompareFileTime
ResumeThread
CreateThread
GetCommandLineW
TerminateProcess
OpenProcess
GetCurrentProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
GetVersionExA
GetSystemDirectoryA
FindFirstFileA
FindNextFileA
FindClose
DosDateTimeToFileTime
LocalFileTimeToFileTime
GetUserDefaultLCID
EnumSystemLocalesA
GetLocaleInfoA
SetFileTime
SetFileAttributesA
CreateFileA
GetFileAttributesA
GetFileInformationByHandle
CloseHandle
FileTimeToLocalFileTime
FileTimeToDosDateTime
GetDriveTypeA
IsValidCodePage
IsValidLocale
HeapAlloc
HeapFree
GetFileType
ReadFile
WriteFile
SetFilePointer
RtlUnwind
RaiseException
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
IsBadWritePtr
SetEndOfFile
SetHandleCount
GetStdHandle
SetStdHandle
HeapSize
SetUnhandledExceptionFilter
GetProcAddress
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetCPInfo
GetACP
GetOEMCP
IsBadReadPtr
IsBadCodePtr
FlushFileBuffers
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
LoadLibraryA
LCMapStringA
LCMapStringW
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetLocaleInfoW
user32
MessageBoxA
advapi32
RegSetValueExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegOpenKeyExA
shell32
ShellExecuteA
CommandLineToArgvW
cabinet
FCICreate
FDICopy
FDIIsCabinet
FDIDestroy
FDICreate
FCIDestroy
FCIAddFile
FCIFlushCabinet
psapi
EnumProcessModules
GetModuleFileNameExA
Sections
.text Size: 120KB - Virtual size: 118KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 16KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 12KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 104KB - Virtual size: 104KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
kfikccu Size: 4KB - Virtual size: 80KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE