Static task
static1
Behavioral task
behavioral1
Sample
82f0e706d9f1a4cea73791e685f8c76f_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
82f0e706d9f1a4cea73791e685f8c76f_JaffaCakes118.exe
Resource
win10v2004-20240730-en
General
-
Target
82f0e706d9f1a4cea73791e685f8c76f_JaffaCakes118
-
Size
805KB
-
MD5
82f0e706d9f1a4cea73791e685f8c76f
-
SHA1
5b52f8978baf49bc81873b3cec857c8e52c0e97c
-
SHA256
cad8651f02214ce88ba4bd26576970189b6244af046410329d5f0a9a88cfc356
-
SHA512
82ad9ecaedaf08c2cce61634c033903950528a16c803cb523c12bb0e86b2e55ea156e5739314fd57e10ef75003fa7300f4e4b59449d41f0c31512e2641195be0
-
SSDEEP
12288:/AD6QkdYq0+/Z7Hdu4fUuLQR4GOYM2gxM:glgvg4fbuf+2l
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 82f0e706d9f1a4cea73791e685f8c76f_JaffaCakes118
Files
-
82f0e706d9f1a4cea73791e685f8c76f_JaffaCakes118.exe windows:5 windows x86 arch:x86
be8f5ae06a46dcfc3da3c7cc25d502bc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
VirtualProtect
GetProcessHeap
GetProcAddress
CreateFileW
VirtualAlloc
MultiByteToWideChar
VirtualAlloc
GetLastError
CreateThread
lstrlenA
GetLastError
lstrlenA
InterlockedDecrement
GetTickCount
SetLastError
GetProcAddress
ReadFile
GetProcessHeap
MultiByteToWideChar
DisableThreadLibraryCalls
GetCurrentProcess
CreateFileW
GetCurrentProcessId
GetCurrentThreadId
ReadFile
CreateThread
LeaveCriticalSection
UnhandledExceptionFilter
CreateFileW
HeapDestroy
HeapAlloc
InitializeCriticalSection
GetProcAddress
GetProcAddress
HeapFree
CreateFileW
lstrcmpiW
CreateFileW
InitializeCriticalSection
GetSystemTimeAsFileTime
GetCurrentThreadId
GetModuleHandleW
GetModuleHandleW
InterlockedCompareExchange
HeapFree
UnhandledExceptionFilter
QueryPerformanceCounter
GetModuleFileNameW
GetProcAddress
VirtualProtect
VirtualProtect
Sleep
LeaveCriticalSection
lstrlenA
LeaveCriticalSection
GetProcessHeap
GetModuleFileNameW
VirtualProtect
GetCurrentProcess
CreateThread
InitializeCriticalSection
GetModuleFileNameW
UnhandledExceptionFilter
InterlockedIncrement
GetProcAddress
InterlockedDecrement
VirtualProtect
LoadLibraryW
GetProcessHeap
lstrcmpiW
InterlockedIncrement
GetTickCount
Sleep
GetLastError
QueryPerformanceCounter
InterlockedCompareExchange
InitializeCriticalSection
CreateFileW
FreeLibrary
MultiByteToWideChar
user32
SetWindowTextW
InvalidateRect
SetWindowLongW
ReleaseDC
SendMessageW
BeginPaint
GetWindowLongW
SetFocus
PostQuitMessage
LoadIconW
KillTimer
ShowWindow
PostQuitMessage
ReleaseDC
GetSysColor
GetWindowLongW
GetDesktopWindow
DialogBoxParamW
LoadStringW
IsDlgButtonChecked
BeginPaint
SetWindowTextW
EndPaint
GetFocus
TranslateMessage
EndDialog
TranslateMessage
EnableWindow
PostMessageW
GetWindowRect
TranslateMessage
ReleaseDC
LoadStringW
SendDlgItemMessageW
GetClientRect
SetTimer
GetFocus
LoadCursorW
GetWindowRect
KillTimer
PostQuitMessage
ReleaseDC
SetWindowPos
GetSystemMetrics
SendDlgItemMessageW
CreateWindowExW
GetDlgItem
wsprintfA
TranslateMessage
GetFocus
DispatchMessageW
PeekMessageW
LoadIconW
GetDesktopWindow
TranslateMessage
MessageBoxW
GetWindowRect
SetWindowPos
EndPaint
GetParent
ShowWindow
DestroyWindow
MessageBoxW
LoadStringW
GetDesktopWindow
GetDesktopWindow
PostMessageW
GetFocus
GetDC
SetCursor
ReleaseDC
DestroyWindow
GetWindowLongW
EndPaint
DialogBoxParamW
CreateWindowExW
DestroyWindow
EnableWindow
DefWindowProcW
PeekMessageW
GetWindowLongW
GetDlgItem
LoadStringW
CreateWindowExW
LoadCursorW
Sections
.text Size: 718KB - Virtual size: 968KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 82KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ