Static task
static1
Behavioral task
behavioral1
Sample
af7d522dcc19adc7ce07235df17b0f7f_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
af7d522dcc19adc7ce07235df17b0f7f_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
af7d522dcc19adc7ce07235df17b0f7f_JaffaCakes118
-
Size
260KB
-
MD5
af7d522dcc19adc7ce07235df17b0f7f
-
SHA1
3a86597faa2dc7f40306cc10278ce72e323079b3
-
SHA256
95bb7ad02df63be69e5a927d9e16da8bc746ee7e2effa4f550e532b53bddb011
-
SHA512
b966ab5bd7665a567f92d708ac6417f796535bcd2b3583a508fea88920273ec974d83ecc61e9138cfda7fb9a3d85a8139c4729454d5a298f23d867e95890a887
-
SSDEEP
6144:sAPTOCuq51JsmiQFF0kJNOlsh2IiobuUnGsf8AD:soB7BsHQz8JmG0D
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource af7d522dcc19adc7ce07235df17b0f7f_JaffaCakes118
Files
-
af7d522dcc19adc7ce07235df17b0f7f_JaffaCakes118.exe windows:4 windows x86 arch:x86
f982bf68faea31fb085b9351d99b9619
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42u
ord823
ord825
msvcrt
free
_beginthread
atl
ord21
ord18
ord22
ord15
ord16
ord44
ord43
ord32
ord58
ord23
kernel32
GetVersionExW
SetEvent
WaitForSingleObject
IsBadReadPtr
GetNumberFormatW
GetLocaleInfoW
GetCurrentProcess
InitializeCriticalSection
lstrlenW
GetModuleFileNameW
lstrcpyW
GetShortPathNameW
GetModuleHandleW
lstrcmpiW
GetWindowsDirectoryW
GlobalAlloc
GetModuleHandleA
GetLastError
LoadLibraryW
LoadLibraryA
ExpandEnvironmentStringsW
lstrcmpW
GetCurrentThread
lstrcatW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
SetUnhandledExceptionFilter
MultiByteToWideChar
lstrlenA
LocalFree
GetProcessHeap
CreateEventW
GetProcAddress
user32
SetWindowTextW
SetFocus
SendMessageW
SetDlgItemTextW
DialogBoxParamW
SendDlgItemMessageW
wsprintfW
MessageBeep
ShowWindow
GetDlgItemInt
EndDialog
SetDlgItemInt
LoadImageW
SetCursor
LoadCursorW
ShowCursor
IsWindow
PeekMessageW
SetWindowLongW
PostMessageW
EnableWindow
GetDlgItemTextW
LoadBitmapW
IsDlgButtonChecked
LoadIconW
MessageBoxW
WinHelpW
GetSystemMetrics
advapi32
LookupPrivilegeValueW
OpenThreadToken
AdjustTokenPrivileges
ImpersonateSelf
RegOpenKeyW
RegQueryValueExW
GetUserNameW
LookupAccountNameW
RegEnumKeyExW
RegSetValueExW
RegOpenKeyExW
GetTokenInformation
RegDeleteKeyW
RegCloseKey
RegCreateKeyExW
oleaut32
SafeArrayGetLBound
SafeArrayGetElement
SysAllocStringByteLen
VariantChangeType
SafeArrayGetUBound
SysStringByteLen
VariantClear
VariantInit
SysStringLen
SysAllocString
SysFreeString
ole32
CoCreateInstance
CoInitialize
StringFromCLSID
gdi32
GetTextExtentPointW
DeleteObject
shell32
ShellExecuteW
shlwapi
StrFormatByteSizeW
samlib
SamCloseHandle
SamFreeMemory
SamGetGroupsForUser
SamSetMemberAttributesOfGroup
SamiSetDSRMPasswordOWF
SamCreateGroupInDomain
SamGetAliasMembership
SamEnumerateUsersInDomain
SamGetDisplayEnumerationIndex
Sections
.text Size: 14KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.Fq Size: 2KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.SBYeOU Size: 110KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.MDnc Size: 2KB - Virtual size: 279KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.oFOQE Size: 3KB - Virtual size: 363KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 3KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.QHZGU Size: 3KB - Virtual size: 211KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 5KB - Virtual size: 268KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.kUM Size: 107KB - Virtual size: 189KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ