Static task
static1
Behavioral task
behavioral1
Sample
a57131154a013544cbc8442a4e6d8d77_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
a57131154a013544cbc8442a4e6d8d77_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a57131154a013544cbc8442a4e6d8d77_JaffaCakes118
-
Size
59KB
-
MD5
a57131154a013544cbc8442a4e6d8d77
-
SHA1
5624388fe03c16d9f62c49b1da7e4430c0fb0f5b
-
SHA256
2ea6f526c9f3773935052a5f940158ac4b1e0207f6155120b542e160eed0b59f
-
SHA512
950a1b12ed0bd9f918dcf02b6356a9324370fda90b8c128e466596c882a1830508faff9216062d48eaaf93eb20265fd0c9ae46ec66c590d42e676862196de632
-
SSDEEP
768:pshVaz6ziIej6KjGJ0lYKgwGHvePwnmLLmrqdykfLq00UV7n2MTXvQVvAzYv12:pqazs5sGQrg3H4mKj0UV72e
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a57131154a013544cbc8442a4e6d8d77_JaffaCakes118
Files
-
a57131154a013544cbc8442a4e6d8d77_JaffaCakes118.exe windows:5 windows x86 arch:x86
06dd63408600df7e571834b0cdf38bc0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
_except_handler3
_adjust_fdiv
malloc
_initterm
free
wcsstr
wcslen
advapi32
GetTokenInformation
LookupAccountSidW
EqualSid
ImpersonateLoggedOnUser
RevertToSelf
wtsapi32
WTSQueryUserToken
WTSFreeMemory
WTSQuerySessionInformationW
crypt32
CryptProtectData
user32
LoadStringW
kernel32
HeapFree
CreateTimerQueue
DeleteTimerQueueEx
DeleteTimerQueueTimer
WaitForSingleObject
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
HeapAlloc
ChangeTimerQueueTimer
GetProcessHeap
CreateEventW
DeleteCriticalSection
GetLastError
QueueUserWorkItem
CloseHandle
LocalFree
WideCharToMultiByte
CompareStringW
GetComputerNameW
DuplicateHandle
GetCurrentProcess
GetTickCount
InterlockedIncrement
InterlockedDecrement
Sleep
GetCommandLineW
GetVersionExW
WTSGetActiveConsoleSessionId
ProcessIdToSessionId
GetCurrentProcessId
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
CreateTimerQueueTimer
eappcfg
EapHostPeerFreeMemory
EapHostPeerInvokeInteractiveUI
EapHostPeerGetMethods
EapHostPeerFreeErrorMemory
eappprxy
EapHostPeerGetSendPacket
EapHostPeerGetUIContext
EapHostPeerProcessReceivedPacket
EapHostPeerBeginSession
EapHostPeerSetResponseAttributes
EapHostPeerGetResult
EapHostPeerSetUIContext
EapHostPeerFreeEapError
EapHostPeerInitialize
EapHostPeerClearConnection
EapHostPeerGetAuthStatus
EapHostPeerEndSession
EapHostPeerUninitialize
EapHostPeerGetResponseAttributes
rtutils
TraceDeregisterW
TraceVprintfExA
TraceRegisterExW
Sections
.text Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.p102 Size: 512B - Virtual size: 186B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.0x9a9 Size: 512B - Virtual size: 186B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.kalqo Size: 512B - Virtual size: 186B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.88111 Size: 512B - Virtual size: 186B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.9102 Size: 512B - Virtual size: 392B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.1827 Size: 512B - Virtual size: 186B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.7382 Size: 512B - Virtual size: 186B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.81721 Size: 200KB - Virtual size: 200KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ajdiw Size: 512B - Virtual size: 194B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.09a Size: 512B - Virtual size: 208B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.09a5 Size: 512B - Virtual size: 216B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.09a6 Size: 512B - Virtual size: 186B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.11524 Size: 512B - Virtual size: 158B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.9a9s Size: 200KB - Virtual size: 200KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.a4a4 Size: 512B - Virtual size: 158B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.afa4 Size: 512B - Virtual size: 184B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.afa6 Size: 512B - Virtual size: 184B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 296B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ