Static task
static1
Behavioral task
behavioral1
Sample
94ab936ca011a0d3efe0976d8f35f7c6_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
94ab936ca011a0d3efe0976d8f35f7c6_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
94ab936ca011a0d3efe0976d8f35f7c6_JaffaCakes118
-
Size
300KB
-
MD5
94ab936ca011a0d3efe0976d8f35f7c6
-
SHA1
b47b099dc07e066355125369f486178ff6c12e45
-
SHA256
1a4d477c6a74b12bc1eec55ac51b499675c3f65cd1f6f3311126bf5a60841bee
-
SHA512
f018f8b1faa7bcb359b774eda60c1f1d2b7317616a6891e1e10aa70a89b3f10200af51c2d3e6cf5845e920c45dd01c1c6dd88e44fca07d3ce67afbad9c444991
-
SSDEEP
6144:131/xEIXqVqjIhmMgjd5juZpI65t6vShy9:1xtX2gr+NC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 94ab936ca011a0d3efe0976d8f35f7c6_JaffaCakes118
Files
-
94ab936ca011a0d3efe0976d8f35f7c6_JaffaCakes118.exe windows:4 windows x86 arch:x86
29bcc9f5a1fa8b8d578c425a5e032d65
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
HeapFree
HeapReAlloc
lstrlenW
WriteFile
LoadResource
LeaveCriticalSection
LocalFree
EnterCriticalSection
ReadFile
GetFileTime
GetSystemDirectoryA
Process32FirstW
GetFileSize
GetModuleFileNameA
GetVersionExA
GetTempPathA
FindResourceW
SetErrorMode
CreateProcessA
GetWindowsDirectoryW
CreateProcessW
GetVolumeInformationA
GetACP
CreateToolhelp32Snapshot
GetExitCodeThread
CreateThread
CreateEventW
TerminateThread
SetEvent
GetModuleFileNameW
WaitForMultipleObjects
FlushFileBuffers
SetFilePointer
SetStdHandle
lstrlenA
MultiByteToWideChar
CreateFileW
SizeofResource
FindResourceExW
LockResource
DeleteCriticalSection
InitializeCriticalSection
GetLastError
GetProcessHeap
WideCharToMultiByte
WaitForSingleObject
Sleep
FormatMessageW
HeapAlloc
Process32NextW
GetTickCount
SetEndOfFile
SetEnvironmentVariableW
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetConsoleMode
GetConsoleCP
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
CreateFileA
GetExitCodeProcess
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
LoadLibraryA
HeapDestroy
HeapSize
RaiseException
InterlockedExchange
GetLocaleInfoA
GetThreadLocale
InterlockedIncrement
InterlockedDecrement
VirtualProtect
VirtualAlloc
GetProcAddress
GetModuleHandleA
GetSystemInfo
VirtualQuery
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
DeleteFileW
GetLocalTime
ExitProcess
GetCommandLineA
GetStartupInfoA
RtlUnwind
GetStringTypeA
GetStringTypeW
GetCPInfo
LCMapStringA
LCMapStringW
HeapCreate
VirtualFree
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
GetStdHandle
GetFileAttributesW
SetHandleCount
GetFileType
user32
GetActiveWindow
GetKeyboardState
UnregisterClassA
advapi32
QueryServiceStatusEx
OpenSCManagerW
CloseServiceHandle
CreateServiceW
ChangeServiceConfig2W
StartServiceW
RegisterServiceCtrlHandlerW
SetServiceStatus
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExW
RegCloseKey
StartServiceCtrlDispatcherW
ole32
CLSIDFromProgID
CoInitialize
CoCreateInstance
CoUninitialize
StringFromCLSID
ws2_32
WSASocketW
closesocket
WSAStartup
WSARecv
WSACloseEvent
WSACleanup
WSAGetLastError
WSASetEvent
WSAGetOverlappedResult
WSAResetEvent
freeaddrinfo
WSASend
getaddrinfo
WSAConnect
WSAEnumNetworkEvents
WSASetLastError
WSACreateEvent
WSAEventSelect
Sections
.text Size: 248KB - Virtual size: 247KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 36KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ