Static task
static1
Behavioral task
behavioral1
Sample
86a64ba557780c8f936245e34df2809a_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
86a64ba557780c8f936245e34df2809a_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
86a64ba557780c8f936245e34df2809a_JaffaCakes118
-
Size
644KB
-
MD5
86a64ba557780c8f936245e34df2809a
-
SHA1
2a439b97451cb5879d3b1f153409866f0d6ca756
-
SHA256
805da970a3036e88c5ccbbce224bea52bdf5c1a9bb09695f35a9cfee99debd66
-
SHA512
bcca5dceac7467bbda4c085a6d5dbc41f5d635809934316c65e45e73600f5bafe92f46b69aa859c1405776a9a799ceb023b7f35d1ceff39c517a3b593351672f
-
SSDEEP
12288:EqWdXXrvl5mewE6jSt37Q8wDsBzFlsB4/9rtlX181fhjgJ:EqUXrvl/wDjSt37HoW/JX1U5j
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 86a64ba557780c8f936245e34df2809a_JaffaCakes118
Files
-
86a64ba557780c8f936245e34df2809a_JaffaCakes118.exe windows:6 windows x64 arch:x64
493cfbadcf0006dc5f7f862e2d135a0f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
VirtualAlloc
RtlMoveMemory
CreateThread
WaitForSingleObject
CreateFileW
GetFileSizeEx
GetProcessHeap
GetStringTypeW
SetEnvironmentVariableW
Sleep
TlsSetValue
TlsGetValue
TlsFree
SetLastError
TlsAlloc
CloseHandle
WriteFile
GetLastError
GetFileType
SetFilePointer
GetCurrentThreadId
GetStdHandle
GetEnvironmentVariableA
FormatMessageA
LoadLibraryA
GetThreadLocale
IsDebuggerPresent
GetProcAddress
GetModuleHandleA
FreeLibrary
CreateFileA
SetEndOfFile
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
ExitThread
InitializeCriticalSection
CreateEventA
SetEvent
TerminateThread
SetErrorMode
GetCommandLineA
GetACP
SetConsoleCtrlHandler
GetTempPathA
GetTempFileNameA
GetFullPathNameA
GetSystemDefaultLangID
WideCharToMultiByte
GetFullPathNameW
MultiByteToWideChar
GetUserDefaultLangID
ReadFile
DeleteFileA
SetThreadPriority
CreateProcessA
GetSystemTimeAsFileTime
GetCurrentProcess
FlushFileBuffers
QueryPerformanceCounter
GetCurrentProcessId
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
TerminateProcess
GetModuleFileNameA
VirtualQuery
GetCurrentThread
RtlUnwindEx
InitializeCriticalSectionAndSpinCount
LoadLibraryExW
RaiseException
GetModuleHandleExW
GetModuleFileNameW
WriteConsoleW
ExitProcess
GetConsoleOutputCP
GetConsoleMode
SetStdHandle
QueryPerformanceFrequency
GetCommandLineW
HeapAlloc
HeapFree
CompareStringW
LCMapStringW
OutputDebugStringW
HeapReAlloc
HeapSize
SetFilePointerEx
ReadConsoleW
GetFileAttributesExW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
imagehlp
StackWalk64
SymCleanup
SymInitialize
Sections
.text Size: 499KB - Virtual size: 499KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 108KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 14KB - Virtual size: 121KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gehcont Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ