Static task
static1
Behavioral task
behavioral1
Sample
76616c02ff2e98ee052ffd4b58a22003_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
76616c02ff2e98ee052ffd4b58a22003_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
76616c02ff2e98ee052ffd4b58a22003_JaffaCakes118
-
Size
120KB
-
MD5
76616c02ff2e98ee052ffd4b58a22003
-
SHA1
782d652a02c7f409a832f5ae243280cb15b68b0b
-
SHA256
30ff4036aa215eae283877f8b0adfc02fa9ea221d9fcac2a7f89c30ada26e165
-
SHA512
8a2a7dfcdcab174ee8e2aedbf60e5e37abd8b0666b0f1f92c8f165e93ef9b9af1f20034ec4750298e014ffcd869bee5c773760980ddcccfdc6afad98402a3ec3
-
SSDEEP
1536:+/IqXgHpvgZp6uAaI5nFYQ7PHAkv8P9wWZcd2GrFHhSP6tVb:+/IZJvMC9HEm2GrFHhSP6tVb
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 76616c02ff2e98ee052ffd4b58a22003_JaffaCakes118
Files
-
76616c02ff2e98ee052ffd4b58a22003_JaffaCakes118.exe windows:4 windows x86 arch:x86
b8772d68d57a651ae4d08cb05b9c1b52
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
OpenProcess
CopyFileW
GetVersionExW
TerminateProcess
GetModuleFileNameW
Module32First
Process32Next
CreateWaitableTimerW
CreateToolhelp32Snapshot
Module32Next
GetModuleHandleW
DeleteFileW
SetFileAttributesW
CreateFileA
SetEnvironmentVariableA
CompareStringW
CompareStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
Process32First
SetWaitableTimer
CreateMutexW
GetLastError
Sleep
GetTickCount
GetVolumeInformationW
LockResource
SizeofResource
InterlockedDecrement
InterlockedIncrement
LoadResource
FindResourceW
FindResourceExW
CloseHandle
GetEnvironmentVariableW
ReadFile
SetEndOfFile
SetFilePointer
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetLocaleInfoA
FlushFileBuffers
GetConsoleMode
GetConsoleCP
SetStdHandle
MultiByteToWideChar
CreateFileW
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetVersionExA
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
GetSystemTimeAsFileTime
ExitThread
ResumeThread
CreateThread
GetProcAddress
GetModuleHandleA
ExitProcess
GetCommandLineA
GetStartupInfoA
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
VirtualFree
VirtualAlloc
WriteFile
GetStdHandle
GetModuleFileNameA
RtlUnwind
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
WideCharToMultiByte
GetTimeZoneInformation
LoadLibraryA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetCurrentProcessId
GetCPInfo
GetACP
GetOEMCP
user32
UnregisterClassA
PeekMessageW
TranslateMessage
wsprintfW
MessageBoxW
DispatchMessageW
MsgWaitForMultipleObjects
advapi32
RegOpenKeyW
GetUserNameW
QueryServiceConfigA
OpenSCManagerA
QueryServiceStatusEx
ChangeServiceConfigA
StartServiceA
CloseServiceHandle
OpenServiceA
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyW
RegDeleteValueW
shell32
ShellExecuteW
ole32
CoUninitialize
CoInitialize
CoCreateInstance
oleaut32
SysAllocStringByteLen
SysAllocString
VarBstrCmp
SysStringByteLen
VariantInit
VariantClear
SysFreeString
shlwapi
UrlEscapeW
netapi32
NetApiBufferFree
NetUserGetInfo
urlmon
URLDownloadToFileW
Sections
.text Size: 84KB - Virtual size: 80KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 292B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ