Static task
static1
Behavioral task
behavioral1
Sample
788e7f69b7a9bcbd328f88a47daadf8b_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
788e7f69b7a9bcbd328f88a47daadf8b_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
788e7f69b7a9bcbd328f88a47daadf8b_JaffaCakes118
-
Size
420KB
-
MD5
788e7f69b7a9bcbd328f88a47daadf8b
-
SHA1
0d08bb0cecc218aba823eb537a668e2888accf22
-
SHA256
67dcc0fa5a98cd894142c02beb641ebfe8a1e4477f84ff066c94648cd8eb16d8
-
SHA512
b60e6c738ec4c38591f35544b3bfaed0d618999cdf53c49c33acd3fa1fcb0eded194b46b02be97b31f60e25573bf4404f102c4fed23e7894aa136c0dbd97c5db
-
SSDEEP
12288:Sg7eoTs+Qb3J4A8wk8UNJOGYMOM7jrcq931hx:SWeMs+QTJ4A8wktJO7Mxgq931hx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 788e7f69b7a9bcbd328f88a47daadf8b_JaffaCakes118
Files
-
788e7f69b7a9bcbd328f88a47daadf8b_JaffaCakes118.exe windows:5 windows x86 arch:x86
16f918727956e3290e9ef449cc9402d9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegCloseKey
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegQueryValueExA
RegOpenKeyExA
kernel32
InterlockedDecrement
CreateThread
GetCurrentThreadId
lstrlenW
GetModuleFileNameW
HeapReAlloc
WriteFile
CreateFileW
lstrlenA
SetEvent
LocalFree
GetOverlappedResult
ReadFile
LocalAlloc
GetFileSizeEx
MulDiv
FormatMessageW
WaitForSingleObject
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoA
GetCommandLineA
GetVersionExA
ExitProcess
GetProcAddress
LoadLibraryExA
HeapAlloc
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapDestroy
HeapCreate
VirtualFree
LoadLibraryA
GetACP
GetOEMCP
GetCPInfo
VirtualAlloc
RtlUnwind
InterlockedExchange
VirtualQuery
SetFilePointer
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
SetStdHandle
VirtualProtect
GetSystemInfo
GetLocaleInfoA
FlushFileBuffers
InterlockedIncrement
WaitForMultipleObjects
GetLastError
GetModuleHandleA
ResetEvent
HeapFree
GetProcessHeap
CreateEventW
GetStdHandle
CloseHandle
gdi32
GetObjectW
GetDeviceCaps
CreateFontIndirectW
DeleteObject
user32
TranslateMessage
GetMessageW
LoadImageW
GetDC
ReleaseDC
MessageBoxW
SetWindowTextW
ShowWindow
SetDlgItemTextW
SetFocus
SendMessageW
PostThreadMessageW
GetDlgItemTextW
GetDlgItem
GetWindowTextLengthW
EnableWindow
GetWindowLongW
SetWindowLongW
SendDlgItemMessageW
GetParent
PostMessageW
LoadStringW
KillTimer
DispatchMessageW
SetTimer
PostQuitMessage
shell32
SHGetFolderPathW
SHBindToParent
SHGetSpecialFolderPathW
ord155
SHGetPathFromIDListW
SHBrowseForFolderW
ShellExecuteW
ord258
SHSetLocalizedName
comdlg32
GetOpenFileNameW
shlwapi
StrFormatByteSizeW
StrRetToBufW
SHSetValueW
PathFindFileNameW
PathAddExtensionW
PathAppendW
PathRemoveFileSpecW
StrStrIA
PathCombineW
mswsock
AcceptEx
ole32
CoInitialize
CoMarshalInterThreadInterfaceInStream
CoRegisterClassObject
CoRevokeClassObject
CoInitializeEx
CoGetInterfaceAndReleaseStream
CoCreateInstance
CoUninitialize
irprops.cpl
BluetoothAuthenticateDevice
BluetoothEnableDiscovery
BluetoothSelectDevices
BluetoothSelectDevicesFree
BluetoothFindFirstRadio
BluetoothFindRadioClose
BluetoothGetDeviceInfo
Sections
.text Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 100KB - Virtual size: 99KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 95KB - Virtual size: 95KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.xdata Size: 95KB - Virtual size: 95KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 95KB - Virtual size: 95KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 458B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ