Static task
static1
Behavioral task
behavioral1
Sample
8654c56495eb235da6ca3b18bb720457_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
8654c56495eb235da6ca3b18bb720457_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
8654c56495eb235da6ca3b18bb720457_JaffaCakes118
-
Size
120KB
-
MD5
8654c56495eb235da6ca3b18bb720457
-
SHA1
5e436f0352452d9ace31e14b16f7c49434cc3b50
-
SHA256
2f6c2cf27a44791f60f1a74439a5e98f3f121b9a1fc01c6f14f0aab5e03908a9
-
SHA512
138093511c41908e8de9a052020116583c0237feb12269ae1bd6f35f55adf0e0fb1ef454159c215be7ea96332d829520839cd8ca9b85e3aab5de0fe420085b51
-
SSDEEP
3072:/QMMfFhIujs40ruc+NF1zwBjshixtdAT5jDH/mlNSTCwYw:/QMMfFhIujs40ruc+NF1zwBjiixL65jC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8654c56495eb235da6ca3b18bb720457_JaffaCakes118
Files
-
8654c56495eb235da6ca3b18bb720457_JaffaCakes118.exe windows:4 windows x86 arch:x86
824ccc3de4b6c6e668405728e8fdce91
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateEventA
TlsGetValue
TlsSetValue
SetNamedPipeHandleState
CreateFileA
ReadFile
WriteFile
WritePrivateProfileStringA
GetPrivateProfileStringA
GetVersionExA
CopyFileA
CopyFileW
DeleteFileA
DeleteFileW
GetFileAttributesA
GetFileAttributesW
SetFileAttributesA
SetFileAttributesW
RemoveDirectoryA
RemoveDirectoryW
CreateDirectoryA
CreateDirectoryW
CreateFileW
MoveFileA
MoveFileW
MoveFileExA
MoveFileExW
SetEndOfFile
GetFileTime
SetFileTime
TlsAlloc
FindFirstFileA
FindFirstFileW
FindNextFileA
FindNextFileW
FindClose
GetFileSize
CreateEventW
OpenEventA
OpenEventW
SetEvent
ResetEvent
LCMapStringA
GetOEMCP
GetACP
GetCPInfo
LCMapStringW
SetStdHandle
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
GetExitCodeThread
TlsFree
FlushFileBuffers
DisconnectNamedPipe
GetCurrentProcess
GetCurrentThread
DuplicateHandle
GetCurrentThreadId
GetExitCodeProcess
CreateProcessW
CreateProcessA
WaitForSingleObject
CloseHandle
GetSystemDirectoryA
GetModuleFileNameA
lstrlenA
CreateMutexA
GetLastError
CreateThread
Sleep
FreeLibrary
LoadLibraryA
LoadLibraryExA
GetProcAddress
SetFilePointer
GetModuleHandleA
RtlUnwind
ExitProcess
TerminateProcess
GetStartupInfoA
GetCommandLineA
GetVersion
HeapReAlloc
HeapAlloc
HeapSize
HeapFree
SetHandleCount
GetStdHandle
GetFileType
UnhandledExceptionFilter
FreeEnvironmentStringsA
user32
MessageBoxA
DestroyWindow
BeginPaint
EndPaint
PostQuitMessage
DefWindowProcA
FindWindowA
SendMessageA
LoadImageA
LoadCursorA
RegisterClassExA
CreateWindowExA
UpdateWindow
GetMessageA
TranslateMessage
DispatchMessageA
ShowWindow
gdi32
TextOutA
advapi32
EnumServicesStatusA
OpenSCManagerW
OpenSCManagerA
RegEnumValueW
RegEnumValueA
RegQueryInfoKeyW
RegQueryInfoKeyA
RegEnumKeyExW
RegEnumKeyExA
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExW
RegOpenKeyExA
RegCloseKey
RegSetValueExW
RegSetValueExA
RegDeleteValueW
RegDeleteValueA
RegCreateKeyExW
RegCreateKeyExA
RegDeleteKeyW
RegDeleteKeyA
EnumServicesStatusW
Sections
.text Size: 68KB - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 4KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE