Static task
static1
Behavioral task
behavioral1
Sample
a31c381359bf2f86753985d01edabc59_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
a31c381359bf2f86753985d01edabc59_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a31c381359bf2f86753985d01edabc59_JaffaCakes118
-
Size
421KB
-
MD5
a31c381359bf2f86753985d01edabc59
-
SHA1
5a888fbb665527489148a626962c6747ab850798
-
SHA256
eba977a690545676d3672758f94179c561a7b473c60584f43df229b27f6b4ef9
-
SHA512
e3c01afae061c167c7a7badb78b5742f4005fc0d548905b677719fc73cf0a5c0ca814470b095a75884ad98add63acc35b4aefc4634278c3f60273674765a1c20
-
SSDEEP
384:Y3Ntb9WPYYTwAB+GNs7mhdOJAbUKTpGbzcGTByC/O10IgGF0:Y9tRWfTrB3sKsSMIgS0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a31c381359bf2f86753985d01edabc59_JaffaCakes118
Files
-
a31c381359bf2f86753985d01edabc59_JaffaCakes118.exe windows:5 windows x86 arch:x86
1a630aa9860dd58002c1003f0ba8cafe
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
RegSetValueExA
RegQueryInfoKeyW
CreateWellKnownSid
GetWindowsAccountDomainSid
CopySid
GetTokenInformation
OpenProcessToken
RegEnumKeyA
CryptHashData
CryptDestroyHash
CryptCreateHash
CryptAcquireContextA
CryptReleaseContext
RegQueryValueExA
CryptGetHashParam
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegCloseKey
RegNotifyChangeKeyValue
RegDeleteValueA
RegOpenKeyExA
RegCreateKeyExA
RegEnumKeyExA
RegDeleteKeyA
user32
CharNextA
GetDesktopWindow
wsprintfA
DispatchMessageW
RegisterClassA
LoadImageA
GetSystemMetrics
DispatchMessageA
PostMessageA
AppendMenuA
CreatePopupMenu
ShowWindow
MsgWaitForMultipleObjectsEx
GetCursorPos
DefWindowProcA
IsWindowUnicode
PeekMessageA
CreateWindowExA
GetWindowLongA
SetWindowLongA
MessageBoxA
DestroyWindow
GetMessageA
GetMessageW
PostQuitMessage
TrackPopupMenu
SetForegroundWindow
LoadStringA
TranslateMessage
kernel32
GetCPInfo
LCMapStringW
RtlUnwind
HeapReAlloc
SetStdHandle
FindFirstFileExW
GetDriveTypeW
FileTimeToLocalFileTime
GetFullPathNameW
CreateDirectoryW
GetConsoleMode
GetConsoleCP
GetFileType
GetStartupInfoW
HeapSetInformation
GetSystemTimeAsFileTime
VirtualQuery
GetSystemInfo
GetModuleHandleW
VirtualAlloc
VirtualProtect
HeapAlloc
HeapFree
DecodePointer
EncodePointer
GetStringTypeW
InterlockedExchange
InterlockedCompareExchange
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
GetTimeZoneInformation
HeapCreate
FindResourceA
lstrcmpA
lstrlenA
GetModuleHandleExA
FreeLibrary
LoadResource
SystemTimeToTzSpecificLocalTime
InterlockedIncrement
InterlockedDecrement
WaitForSingleObject
GetCommandLineA
WideCharToMultiByte
InitializeCriticalSectionAndSpinCount
SizeofResource
CreateEventA
SetDllDirectoryA
IsDBCSLeadByte
lstrcatA
MultiByteToWideChar
lstrlenW
RaiseException
GetLastError
lstrcmpiA
GetProcAddress
WaitForMultipleObjects
GetModuleHandleA
LoadLibraryExA
CreateMutexA
DeleteCriticalSection
CloseHandle
SetEvent
ResetEvent
CreateThread
lstrcpyA
lstrcpynA
CreateFileA
WriteFile
Sleep
ReadFile
OpenEventA
GetCurrentProcess
GetTickCount
GetVersionExA
GetCurrentProcessId
GetTempPathA
LocalFree
DeleteFileA
FileTimeToSystemTime
FormatMessageW
GetLocalTime
GetCurrentThreadId
PeekNamedPipe
SetHandleInformation
GetExitCodeProcess
CreateProcessA
TerminateProcess
CreatePipe
ExitProcess
GetLocaleInfoA
OpenProcess
GetSystemDirectoryA
FindClose
LoadLibraryA
LockResource
GetNativeSystemInfo
GetSystemDefaultUILanguage
GetThreadLocale
GetUserDefaultUILanguage
GetFileAttributesA
GetStdHandle
LoadLibraryExW
GetModuleHandleExW
LoadLibraryW
CreateFileW
SetFilePointerEx
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetModuleFileNameW
HeapSize
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetLocaleInfoW
SetHandleCount
SetFilePointer
FlushFileBuffers
GetACP
GetOEMCP
IsValidCodePage
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
SetEndOfFile
GetProcessHeap
WriteConsoleW
GetCurrentDirectoryW
GetFileInformationByHandle
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
CompareStringW
SetEnvironmentVariableA
GetModuleFileNameA
oleaut32
VarUI4FromStr
crypt32
CryptStringToBinaryA
CryptUnprotectData
CryptProtectData
CryptBinaryToStringA
msi
ord189
ord91
ord117
ord141
ord168
ord67
ord158
ord115
ord159
ord8
ord44
ord204
ord31
ord160
ord137
Sections
.text Size: 305KB - Virtual size: 304KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 50KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 53KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 40B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ