Static task
static1
Behavioral task
behavioral1
Sample
8adf9078333a86b1615e5b629a4defe4_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
8adf9078333a86b1615e5b629a4defe4_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
8adf9078333a86b1615e5b629a4defe4_JaffaCakes118
-
Size
131KB
-
MD5
8adf9078333a86b1615e5b629a4defe4
-
SHA1
d3e760b67cec5a571691df20f1b7cb6f7e654650
-
SHA256
0ab3e6335ca9eb7928b09101fa2d5370f309ff56d757f6ff6d77d29b3451a545
-
SHA512
7cfa3361a07e40f08501f7e1204a6f51af531c882738946377c4e515d6c7eb81543e69b3e2b7edf297f264b8490eb6bae799c5ad40d81e1bcaa8b305a3bca486
-
SSDEEP
1536:LKg9DyM9QhtacTGeMSGsO4ePqISTIetkcP4O0YDojS+1Jz7QMT58T6HpebQc:LKWy4Q5TraPqISkR1sDo++1Jz7Q6Hpm
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8adf9078333a86b1615e5b629a4defe4_JaffaCakes118
Files
-
8adf9078333a86b1615e5b629a4defe4_JaffaCakes118.exe windows:4 windows x86 arch:x86
a5c13d424614496c72ba80a4f56db4ad
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrcmpiA
WriteConsoleW
SetFileAttributesA
CreateProcessA
GetCPInfo
FormatMessageA
SetSystemPowerState
GetSystemTimeAsFileTime
user32
DeferWindowPos
GetMessageA
CloseClipboard
EndDialog
RegisterWindowMessageA
TranslateMessage
GetPropA
UnregisterHotKey
CreateMenu
BeginDeferWindowPos
LoadIconA
ReleaseCapture
OffsetRect
advapi32
RegEnumKeyA
DeleteService
GetTokenInformation
LookupPrivilegeValueA
OpenSCManagerA
OpenServiceA
OpenThreadToken
QueryServiceStatus
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
AllocateAndInitializeSid
FreeSid
OpenProcessToken
StartServiceCtrlDispatcherA
InitializeSecurityDescriptor
RegDeleteKeyA
RegSetValueExA
RegisterServiceCtrlHandlerA
SetEntriesInAclA
SetSecurityDescriptorDacl
RegOpenKeyA
SetServiceStatus
userenv
DestroyEnvironmentBlock
CreateEnvironmentBlock
UnloadUserProfile
msvcrt
fread
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__p___initenv
exit
_XcptFilter
_exit
strlen
atol
memmove
fclose
_itoa
fseek
fopen
Sections
.text Size: 80KB - Virtual size: 79KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 40KB - Virtual size: 129KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ