Static task
static1
Behavioral task
behavioral1
Sample
ae79d6cd65ca42c0692c0871ce3167f4_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
ae79d6cd65ca42c0692c0871ce3167f4_JaffaCakes118
-
Size
140KB
-
MD5
ae79d6cd65ca42c0692c0871ce3167f4
-
SHA1
f696e8fafb510c875c761935599e63bb075728d7
-
SHA256
b915d344b1cbc0c40e8eee619d80d77f90486af4371af2af6648836f766133c3
-
SHA512
21e53efa5ccf6361e2cca4c0dd3df48627b573cced71fdb875278d6102ef2be6fea2d78441ec982ab7dec31dfc018311b7c2c1deeb690e778cdcfb5337648b60
-
SSDEEP
3072:SZouetgnNQXYrLz1gpn+L0FNl6iNfUkn+05oQBql:WDnNHL1gp+IF8ok
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ae79d6cd65ca42c0692c0871ce3167f4_JaffaCakes118
Files
-
ae79d6cd65ca42c0692c0871ce3167f4_JaffaCakes118.exe windows:4 windows x86 arch:x86
4f3952f81018459cce35d40f6518f29f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LeaveCriticalSection
EnterCriticalSection
ProcessIdToSessionId
GetCurrentProcessId
VirtualQuery
GetSystemInfo
VirtualProtect
GetLocaleInfoA
Sleep
GetOEMCP
GetACP
GetStringTypeW
GetStringTypeA
LCMapStringW
MultiByteToWideChar
LCMapStringA
GetFileType
SetHandleCount
GetEnvironmentStringsW
GetVersionExA
LoadLibraryA
GetProcAddress
FreeLibrary
CreateMutexA
InitializeCriticalSection
ReleaseMutex
DeleteCriticalSection
CreateFileA
CloseHandle
GetCPInfo
GetLastError
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetModuleFileNameA
HeapFree
HeapAlloc
ExitProcess
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
WriteFile
GetStdHandle
RtlUnwind
user32
IsWindow
RegisterDeviceNotificationA
UnregisterDeviceNotification
DestroyWindow
DefWindowProcA
CreateWindowExA
UpdateWindow
RegisterClassA
FindWindowA
SendMessageA
GetMessageA
DispatchMessageA
TranslateMessage
PostQuitMessage
gdi32
GetStockObject
advapi32
RegOpenKeyExA
RegCloseKey
RegEnumValueA
hid
HidD_FreePreparsedData
HidD_GetAttributes
HidD_GetPreparsedData
HidP_GetCaps
HidD_GetHidGuid
setupapi
SetupDiGetClassDevsA
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInstanceIdA
SetupDiGetDeviceInterfaceDetailA
Sections
.text Size: 20KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 104KB - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ