Static task
static1
Behavioral task
behavioral1
Sample
a94e723c3c1e56b748bbeaf4f73929b7_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
a94e723c3c1e56b748bbeaf4f73929b7_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a94e723c3c1e56b748bbeaf4f73929b7_JaffaCakes118
-
Size
587KB
-
MD5
a94e723c3c1e56b748bbeaf4f73929b7
-
SHA1
6c871788539e4ffd83e2757c2210e7c000b06f60
-
SHA256
b3211431b5789895117779f5c9589565c9460d23d66d6f6928187c1eab5d50b4
-
SHA512
68627dbfa0d20efd642d90cdc1addc3d6833bff3172a34e0856c62b15cea05d09f1005d847ae7ce640b9b679af5802d372562ac0430e99d0195b67d6cd761eb9
-
SSDEEP
12288:MSx0IMRyKSfof7nXJaxf9MYwG5Ik/feNxCbuWFEjcMGLYaSt1+cDBF2bH1Vmre3O:MSGwI7ctlONxCIjpGLYZTjDBoHXV3zL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a94e723c3c1e56b748bbeaf4f73929b7_JaffaCakes118
Files
-
a94e723c3c1e56b748bbeaf4f73929b7_JaffaCakes118.exe windows:4 windows x86 arch:x86
17906cc8728ac0560d387368e7965a18
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
wininet
InternetAlgIdToStringA
InternetGetConnectedStateEx
InternetTimeFromSystemTimeA
InternetSetFilePointer
RetrieveUrlCacheEntryFileA
InternetGoOnlineA
HttpSendRequestA
InternetQueryOptionA
GetUrlCacheGroupAttributeA
InternetGetCookieA
InternetOpenA
DeleteUrlCacheGroup
InternetQueryFortezzaStatus
GetUrlCacheEntryInfoA
CommitUrlCacheEntryW
InternetConnectW
RunOnceUrlCache
InternetTimeToSystemTimeW
FtpCreateDirectoryW
FindFirstUrlCacheContainerW
InternetSetOptionA
RetrieveUrlCacheEntryFileW
FtpRemoveDirectoryA
InternetFindNextFileA
GetUrlCacheHeaderData
user32
AppendMenuA
GetSysColorBrush
DdeUnaccessData
IsDialogMessageA
shell32
SHChangeNotify
ExtractIconA
DuplicateIcon
SHEmptyRecycleBinW
SHFileOperationA
SHGetDataFromIDListA
RealShellExecuteExW
DoEnvironmentSubstW
SHGetPathFromIDListA
DragQueryFile
SHGetInstanceExplorer
advapi32
CryptDuplicateHash
RegOpenKeyExA
LookupSecurityDescriptorPartsW
kernel32
ExitProcess
LocalSize
HeapReAlloc
HeapValidate
CreateEventA
HeapSize
TerminateProcess
GetTimeZoneInformation
GetStartupInfoA
IsValidLocale
TlsGetValue
Sleep
GetOEMCP
HeapFree
EnumSystemLocalesA
InterlockedDecrement
SetEnvironmentVariableA
IsValidCodePage
GetTickCount
OutputDebugStringA
FreeEnvironmentStringsW
LeaveCriticalSection
GetStdHandle
IsDebuggerPresent
GetCurrentProcessId
SetHandleCount
SetFilePointer
LCMapStringA
DebugBreak
VirtualQuery
GlobalLock
MultiByteToWideChar
GetConsoleOutputCP
FreeLibrary
GetLastError
GetLocalTime
GetUserDefaultLCID
GetDateFormatA
GetModuleFileNameA
LoadLibraryA
WaitNamedPipeA
IsBadReadPtr
GetProcessHeap
WriteConsoleA
UnhandledExceptionFilter
WriteConsoleW
GetEnvironmentStringsW
GetConsoleCP
SetLastError
HeapAlloc
CloseHandle
OutputDebugStringW
CompareStringA
LCMapStringW
GetModuleHandleA
QueryPerformanceCounter
HeapDestroy
lstrlenA
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
SetUnhandledExceptionFilter
GetStringTypeA
RaiseException
GetCPInfo
SetStdHandle
GetFileType
WritePrivateProfileStructA
WriteFile
WideCharToMultiByte
GetLocaleInfoW
TlsSetValue
EnumDateFormatsA
GetConsoleMode
GlobalFindAtomW
HeapCreate
GetStartupInfoW
GetModuleFileNameW
TlsAlloc
InterlockedExchange
GlobalHandle
InterlockedIncrement
VirtualFreeEx
EnumCalendarInfoExA
GetCommandLineW
VirtualAlloc
GetCurrentThreadId
FlushFileBuffers
LoadLibraryW
VirtualFree
OpenEventA
CompareStringW
GetCurrentThread
DeleteCriticalSection
GetLocaleInfoA
SetConsoleCtrlHandler
GetACP
SetWaitableTimer
GetModuleHandleW
RtlUnwind
GetTimeFormatA
GetStringTypeW
EnterCriticalSection
GetProcAddress
GetPrivateProfileStringW
TlsFree
CreateFileA
Sections
.text Size: 266KB - Virtual size: 266KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 314KB - Virtual size: 323KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ