Static task
static1
Behavioral task
behavioral1
Sample
74f3744278b93a12ee056c83f8623924_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
74f3744278b93a12ee056c83f8623924_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
74f3744278b93a12ee056c83f8623924_JaffaCakes118
-
Size
319KB
-
MD5
74f3744278b93a12ee056c83f8623924
-
SHA1
92ca944ea53e855b7be94e9eafc0a0051e4f780b
-
SHA256
bbbfb74369b07ae7b4b942f15d0e15eeade44783d9fad2a1ee6c91f42e675f3f
-
SHA512
7028104ab865b23a7cce355aa436c2816d3ea606e59e6172b36b4d1147ea3d088d6de5127183f7c3057b1ef34fb41a6957411bf345b52ab4946b167c9d7f4a8b
-
SSDEEP
6144:3in+DskApPicO5MJmjLED/cyhZ4eU82wn:3in+Dtw6cOemehHU82O
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 74f3744278b93a12ee056c83f8623924_JaffaCakes118
Files
-
74f3744278b93a12ee056c83f8623924_JaffaCakes118.exe windows:5 windows x86 arch:x86
096b085d1d9d59c40b0baef8d1e94bfc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
CloseServiceHandle
StartServiceW
ControlService
QueryServiceStatus
OpenServiceW
CreateServiceW
OpenSCManagerW
DeleteService
SetServiceStatus
RegisterServiceCtrlHandlerW
StartServiceCtrlDispatcherW
CreateProcessAsUserW
AdjustTokenPrivileges
SetTokenInformation
DuplicateTokenEx
LookupPrivilegeValueW
OpenProcessToken
kernel32
GetLocalTime
lstrcpyW
SetFileAttributesW
DeleteFileW
CloseHandle
WaitForSingleObject
CreateProcessW
lstrcatW
GetSystemDirectoryW
CopyFileW
GetProcAddress
LoadLibraryW
GetModuleFileNameW
lstrlenA
WriteFile
ReadFile
GetFileSize
CreateFileW
GetTempFileNameW
GetTempPathW
lstrcmpiW
lstrlenW
GetComputerNameW
MultiByteToWideChar
GetACP
GetDriveTypeW
Sleep
RemoveDirectoryW
GetFileAttributesW
FindClose
FindNextFileW
FindFirstFileW
FileTimeToSystemTime
FileTimeToLocalFileTime
FreeLibrary
LockResource
LoadResource
FindResourceW
EndUpdateResourceW
UpdateResourceW
SizeofResource
GetLastError
BeginUpdateResourceW
SystemTimeToFileTime
GetFileTime
lstrcpynW
GetWindowsDirectoryW
CreateDirectoryW
DeviceIoControl
GetDiskFreeSpaceW
GetModuleHandleW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
OpenProcess
WideCharToMultiByte
GetVersionExW
lstrcmpW
TerminateThread
SetEvent
FindNextChangeNotification
FindCloseChangeNotification
WaitForMultipleObjects
FindFirstChangeNotificationW
GetCommandLineW
GetCurrentThreadId
CreateThread
CreateEventW
GetStartupInfoW
GetVersionExA
GetTimeFormatA
GetDateFormatA
HeapFree
HeapAlloc
ExitProcess
GetModuleHandleA
GetStdHandle
GetModuleFileNameA
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
SetHandleCount
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
GetTimeZoneInformation
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapReAlloc
SetFilePointer
LoadLibraryA
SetStdHandle
FlushFileBuffers
RtlUnwind
SetEndOfFile
GetProcessHeap
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
CompareStringA
GetCPInfo
CompareStringW
GetOEMCP
SetEnvironmentVariableA
GetLocaleInfoA
user32
ShowWindow
CreateWindowExW
DispatchMessageW
TranslateMessage
GetMessageW
GetForegroundWindow
PostThreadMessageW
GetInputState
RegisterClassExW
LoadCursorW
SendMessageW
FindWindowExW
GetClassNameW
PostQuitMessage
LookupIconIdFromDirectoryEx
DefWindowProcW
GetSystemMetrics
shlwapi
PathFileExistsW
shell32
ShellExecuteW
SHGetFolderPathW
SHFileOperationW
CommandLineToArgvW
Sections
.text Size: 69KB - Virtual size: 69KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 3KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 196KB - Virtual size: 196KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE