Static task
static1
Behavioral task
behavioral1
Sample
a5fd5777c0f8b849d42f1fac65d152dc_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
a5fd5777c0f8b849d42f1fac65d152dc_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a5fd5777c0f8b849d42f1fac65d152dc_JaffaCakes118
-
Size
113KB
-
MD5
a5fd5777c0f8b849d42f1fac65d152dc
-
SHA1
6cae1b15e1f5b0816b4027c3c1ba11e54be02799
-
SHA256
03f1445482ad2244c357da646aecdc93a72f455c3fa0a579129c7434c66d02eb
-
SHA512
6eabca33a95eea2f6ab9b18e448b5acb00920b7b35f4a2be0dd193a76ff8f7c1fdcdfee568b1f97b4aa876ce44e9f285a40aacfe4a571c71423c49d43c54b019
-
SSDEEP
3072:PTYJwDK56omkHbql+v+l16qEjsX3+7F5I7+JgpvmmF:rit+Iv+l0qJXIjJfmF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a5fd5777c0f8b849d42f1fac65d152dc_JaffaCakes118
Files
-
a5fd5777c0f8b849d42f1fac65d152dc_JaffaCakes118.exe windows:5 windows x86 arch:x86
09e40971018bb945a4a3305ec65a5c51
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
LoadStringW
wsprintfW
MessageBoxW
kernel32
InitializeCriticalSection
LocalAlloc
LocalFree
LeaveCriticalSection
IsBadWritePtr
DisableThreadLibraryCalls
GetProcAddress
EnterCriticalSection
lstrcpynW
lstrlenW
ExpandEnvironmentStringsW
lstrcpyW
GetCommandLineW
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
SetHandleCount
LoadLibraryA
GetFileSize
GetStartupInfoW
GetStdHandle
HeapCreate
VirtualFree
GetModuleFileNameW
GetCPInfo
GetACP
GetOEMCP
FreeEnvironmentStringsA
MultiByteToWideChar
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
WideCharToMultiByte
WriteFile
HeapAlloc
HeapFree
VirtualAlloc
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
HeapDestroy
advapi32
RegEnumKeyExW
RegQueryValueExW
RegSetValueExW
RegOpenKeyExW
RegCloseKey
RegEnumValueW
Sections
.text Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.0e3c Size: 512B - Virtual size: 218B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.1oqp Size: 512B - Virtual size: 208B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.15as Size: 512B - Virtual size: 208B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.a9as Size: 512B - Virtual size: 206B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.klkl Size: 512B - Virtual size: 206B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.psi Size: 512B - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.teta Size: 512B - Virtual size: 206B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ks1 Size: 512B - Virtual size: 206B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.1231 Size: 512B - Virtual size: 206B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.1237 Size: 512B - Virtual size: 208B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.zetaa Size: 360KB - Virtual size: 359KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.zeta0 Size: 512B - Virtual size: 206B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tetaX Size: 512B - Virtual size: 206B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.1324 Size: 512B - Virtual size: 206B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.1724 Size: 512B - Virtual size: 206B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.9182 Size: 512B - Virtual size: 70B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.9381 Size: 512B - Virtual size: 158B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 260B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ