Static task
static1
Behavioral task
behavioral1
Sample
93e85890918ba98b33f1e8efb9b42d7f_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
93e85890918ba98b33f1e8efb9b42d7f_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
93e85890918ba98b33f1e8efb9b42d7f_JaffaCakes118
-
Size
116KB
-
MD5
93e85890918ba98b33f1e8efb9b42d7f
-
SHA1
9922e664f5a7e4f5233e67594078ccd0a1a8008e
-
SHA256
e9048810889e73a1b62dcf598c69dc4b730b13a4b5287bdf9dc089d687f4c92f
-
SHA512
120fd2e25d0dfcbd2f5dcb027d37015507fde4c6b1fcf0d546861545727caec2dbae5033e56654125acc20b5a8f6f1ff1fdd7a38ec221f96f1e908d5ec1b0db3
-
SSDEEP
3072:elM+TJMpOSFQFJsPz1/g4USwL/djFiJangU:sM+TJ4FMo1JUSwRjQJcgU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 93e85890918ba98b33f1e8efb9b42d7f_JaffaCakes118
Files
-
93e85890918ba98b33f1e8efb9b42d7f_JaffaCakes118.exe windows:5 windows x86 arch:x86
d34bb94ec429d2a987a0fd0158b63c53
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
msvcrt
_exit
_XcptFilter
exit
_initterm
??3@YAXPAX@Z
_ftol
wcslen
wcscpy
_wtol
__p__commode
__setusermatherr
_adjust_fdiv
_except_handler3
__p__fmode
__set_app_type
_controlfp
strtok
??2@YAPAXI@Z
wprintf
vwprintf
_wcsicmp
_wcsnicmp
free
malloc
__wgetmainargs
__p___winitenv
swprintf
advapi32
CryptAcquireContextA
CryptGetUserKey
CryptReleaseContext
CryptDestroyKey
CryptGenKey
kernel32
GetVersionExA
CloseHandle
FindResourceA
LoadResource
CompareFileTime
DeleteFileW
DeleteFileA
CreateFileW
CreateFileA
LockResource
FreeResource
SetLastError
SizeofResource
GetSystemTimeAsFileTime
FileTimeToSystemTime
GetUserDefaultLCID
SystemTimeToFileTime
LocalFileTimeToFileTime
GetLastError
GetModuleHandleA
LocalAlloc
LocalFree
WriteFile
GetFileSize
MultiByteToWideChar
WideCharToMultiByte
ReadFile
user32
LoadStringA
LoadStringW
ole32
CoCreateGuid
CoUninitialize
CoInitialize
oleaut32
VarDateFromStr
signer
PvkPrivateKeyAcquireContextFromMemory
PvkPrivateKeySave
FreeCryptProvFromCert
PvkFreeCryptProv
SignError
PvkGetCryptProv
GetCryptProvFromCert
crypt32
CertStrToNameW
CertFindCertificateInStore
CertEnumCertificatesInStore
CertDuplicateCertificateContext
CertGetCertificateContextProperty
CryptHashCertificate
CryptEncodeObject
CryptExportPublicKeyInfo
CryptHashPublicKeyInfo
CryptDecodeObject
CertCreateCertificateContext
CertComparePublicKeyInfo
CertAddEncodedCertificateToStore
CertSetCertificateContextProperty
CertOpenStore
CertFreeCertificateContext
CertCloseStore
CryptSignAndEncodeCertificate
Sections
.text Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tdata Size: 72KB - Virtual size: 72KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE