Static task
static1
Behavioral task
behavioral1
Sample
829c153c9765cf800c63cee37de76c74_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
829c153c9765cf800c63cee37de76c74_JaffaCakes118.exe
Resource
win10v2004-20240730-en
General
-
Target
829c153c9765cf800c63cee37de76c74_JaffaCakes118
-
Size
455KB
-
MD5
829c153c9765cf800c63cee37de76c74
-
SHA1
c399c13055e9a6bce3ef48bcaadb98a9965a19d7
-
SHA256
6820f0bef8cd4a5916e9afb799c10d6cae970fe9aa36b56e5858d01721f32c40
-
SHA512
94ce5f18a4784a121b8e3e640aa5e1541cdf44b2731ba3781d11254dca97c5974a1691f7d9d37edd6d29e7fdbf59ae09b20d642dd06ea42a1803f21a74a4a961
-
SSDEEP
6144:ApG26lxm3QzQlHNXTwbNWNjCdwb29fBj9ZG7407QtfL3O6q3KI9GfC:ZPdz8Jw4zbYy2LlJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 829c153c9765cf800c63cee37de76c74_JaffaCakes118
Files
-
829c153c9765cf800c63cee37de76c74_JaffaCakes118.exe windows:5 windows x86 arch:x86
a8f29cd51bcaf655e660286f12ddaa15
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
_except_handler3
strncpy
sprintf
wcscpy
wcsncpy
memmove
wcschr
wcslen
free
malloc
_initterm
_adjust_fdiv
kernel32
GetTempFileNameW
LoadLibraryA
MoveFileA
GetFileAttributesA
FileTimeToDosDateTime
WideCharToMultiByte
FreeLibrary
GetProcAddress
LoadLibraryW
lstrcpyW
CloseHandle
LocalFree
SetEvent
Sleep
InterlockedExchange
InterlockedCompareExchange
GetLastError
LocalAlloc
VerifyVersionInfoW
SetFileAttributesA
CreateEventW
WaitForSingleObject
ReleaseMutex
WaitForMultipleObjects
GetTickCount
SetThreadPriority
GetCurrentThread
CreateThread
GetCurrentThreadId
SetLastError
lstrlenW
SetFileAttributesW
CreateDirectoryW
GetFileAttributesW
CompareStringW
lstrcmpiW
lstrcatW
DeleteFileW
CreateFileW
WriteFile
ReadFile
SetFileTime
MoveFileW
SetEndOfFile
GetFileSize
SetFilePointer
GetVolumeInformationW
FindClose
FindFirstFileW
MultiByteToWideChar
RaiseException
GetDriveTypeW
GetEnvironmentVariableW
OutputDebugStringA
GetDiskFreeSpaceA
lstrcatA
GetWindowsDirectoryA
GlobalFree
OutputDebugStringW
CreateMutexW
GetCurrentProcess
ProcessIdToSessionId
GetCurrentProcessId
DuplicateHandle
QueryPerformanceCounter
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InterlockedIncrement
CreateFileA
InterlockedDecrement
DeviceIoControl
DeleteFileA
lstrcpyA
user32
GetMenu
wvsprintfA
MessageBoxA
CloseDesktop
wsprintfA
wsprintfW
MsgWaitForMultipleObjects
SetThreadDesktop
UnregisterClassW
CheckMenuItem
DefWindowProcW
PostQuitMessage
DestroyWindow
advapi32
RegDeleteValueW
RegQueryValueExA
OpenThreadToken
RevertToSelf
SetThreadToken
OpenProcessToken
DuplicateToken
GetTokenInformation
RegCreateKeyExW
GetLengthSid
RegCloseKey
RegOpenKeyA
RegCreateKeyExA
GetFileSecurityW
GetUserNameA
RegOpenKeyExW
RegQueryValueExW
RegOpenKeyExA
Sections
0 Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 828B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1024B - Virtual size: 92B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 427KB - Virtual size: 426KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 1024B - Virtual size: 70B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ