Static task
static1
Behavioral task
behavioral1
Sample
a9fd64b5063a605097ac64f5dc01da2a_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
a9fd64b5063a605097ac64f5dc01da2a_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a9fd64b5063a605097ac64f5dc01da2a_JaffaCakes118
-
Size
73KB
-
MD5
a9fd64b5063a605097ac64f5dc01da2a
-
SHA1
8b559d8ccbfcb70841ee960fb0c07ea236492e84
-
SHA256
574f386e7bed19cf4b64415380003b4d05a642af9c8d8fa03674e1b00a7ce5c6
-
SHA512
90154059e16455582a319fbf1ff50e42ae6e710f8e4fdf1e5f3970fd371ed983a4c07661b09fc7f2b5a71938e13ed9c6580db5d1c381c4cee33705269e80c368
-
SSDEEP
1536:OqgLNSQ5XpGYeBVmTE5oCgcAKkLCrEMjDTNi92YeHsfyk+:OqQgQ5XpGYMSE3lfkexjDTEReHsfyk+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a9fd64b5063a605097ac64f5dc01da2a_JaffaCakes118
Files
-
a9fd64b5063a605097ac64f5dc01da2a_JaffaCakes118.exe windows:4 windows x86 arch:x86
2f279c6de76abe05fe055037eb9ebd17
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
CloseServiceHandle
CreateServiceA
EqualSid
LookupPrivilegeValueA
OpenProcessToken
OpenSCManagerA
QueryServiceConfig2A
RegEnumKeyExA
RegQueryInfoKeyA
RegQueryValueExA
SetSecurityDescriptorDacl
kernel32
CloseHandle
ContinueDebugEvent
CreateEventA
CreateFileMappingA
CreateThread
DeleteCriticalSection
EnumSystemLocalesA
ExitProcess
ExitThread
ExpandEnvironmentStringsA
FindClose
FindNextFileA
FindResourceA
FlushFileBuffers
FormatMessageA
FreeLibrary
GetCommandLineA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDateFormatA
GetEnvironmentStringsA
GetEnvironmentVariableA
GetFileAttributesA
GetFileType
GetFullPathNameA
GetLastError
GetLocalTime
GetLocaleInfoA
GetModuleFileNameA
GetModuleHandleA
GetOEMCP
GetPrivateProfileSectionNamesA
GetPrivateProfileStringA
GetProcAddress
GetStdHandle
GetStringTypeA
GetSystemDirectoryA
GetSystemInfo
GetSystemTimeAsFileTime
GetThreadLocale
GetThreadTimes
GetTickCount
GetTimeZoneInformation
GetVersion
GetVersionExA
GlobalAlloc
HeapAlloc
HeapDestroy
HeapSize
InterlockedCompareExchange
InterlockedDecrement
InterlockedExchange
LeaveCriticalSection
LoadLibraryA
LoadResource
LocalAlloc
LocalFree
LockResource
OpenEventA
QueryPerformanceCounter
ReadFile
ResetEvent
ResumeThread
SearchPathA
SetEnvironmentVariableA
SetFileTime
SetThreadPriority
VirtualAlloc
VirtualFree
WaitForSingleObject
WriteConsoleA
lstrcatA
lstrcmpiA
user32
BeginPaint
CallNextHookEx
CallWindowProcA
CharNextA
DefWindowProcA
DestroyIcon
DialogBoxParamA
EnumChildWindows
FindWindowA
GetDC
GetDlgItem
GetSubMenu
GetWindowLongA
GetWindowTextA
InflateRect
IsRectEmpty
LoadCursorA
MapWindowPoints
MessageBoxA
RegisterWindowMessageA
SetCursor
SetFocus
SetMenu
SetWindowTextA
TrackPopupMenu
TranslateMessage
UnregisterClassA
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
Sections
.text Size: 35KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.bss Size: 14KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 15KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
fmtsj Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
pppfs Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ