Static task
static1
Behavioral task
behavioral1
Sample
886f3469bb29889747bb38fe258c7f8b_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
886f3469bb29889747bb38fe258c7f8b_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
886f3469bb29889747bb38fe258c7f8b_JaffaCakes118
-
Size
130KB
-
MD5
886f3469bb29889747bb38fe258c7f8b
-
SHA1
e8c2dcf39a7a162955f313b8e6dcb1360c73f830
-
SHA256
0d305fd21ffa4d258abe7a8644bc7768d0b8a7a897559f0cae82bae1dbc8482b
-
SHA512
c76dee9f7718c4ca3435de7469163d2ea7e1645a4b5e96cd320308d9538700035e71521704cd0df9cc2a750b5fc7f5517446ef2a7c7e56cb8dfee6e93569dad9
-
SSDEEP
3072:GAuWweFq53ach/NGqGnmh7DZFikZPwzqDTBB:Gnf5qcrGqnhfbikZPwzEP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 886f3469bb29889747bb38fe258c7f8b_JaffaCakes118
Files
-
886f3469bb29889747bb38fe258c7f8b_JaffaCakes118.exe windows:4 windows x86 arch:x86
f471421ac187f73ecdaa83661a3ad159
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
CryptReleaseContext
CryptCreateHash
RegDeleteValueA
CryptGetHashParam
CryptHashData
GetUserNameW
DuplicateTokenEx
CryptAcquireContextW
RegCreateKeyExA
RegSetValueExA
CryptDestroyHash
user32
GetIconInfo
LoadCursorA
FindWindowExA
CloseWindowStation
GetCursorPos
CharLowerBuffA
CloseDesktop
GetWindowLongA
SetProcessWindowStation
PeekMessageA
DispatchMessageA
GetKeyboardState
GetWindowThreadProcessId
OpenWindowStationA
DrawIcon
GetClassNameA
ToUnicode
MsgWaitForMultipleObjects
kernel32
GetModuleHandleA
Sleep
VirtualAlloc
SetFilePointer
GetModuleFileNameA
GetCurrentThreadId
GetUserDefaultUILanguage
VirtualProtect
CreateMutexW
lstrcpyA
lstrcatA
lstrlenA
OpenMutexW
HeapReAlloc
GetLastError
EnterCriticalSection
SystemTimeToFileTime
FindFirstFileW
GetCommandLineA
MulDiv
LeaveCriticalSection
GetVersionExW
shlwapi
PathCombineW
PathMatchSpecW
StrCmpNIW
wnsprintfW
wnsprintfA
PathRemoveFileSpecW
StrCmpNIA
PathFileExistsW
SHDeleteKeyA
wvnsprintfW
wvnsprintfA
StrStrW
Sections
.text Size: 59KB - Virtual size: 58KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE