Static task
static1
Behavioral task
behavioral1
Sample
aff1e0d0f8b54872fc8a4a33b73e6c1f_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
aff1e0d0f8b54872fc8a4a33b73e6c1f_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
aff1e0d0f8b54872fc8a4a33b73e6c1f_JaffaCakes118
-
Size
128KB
-
MD5
aff1e0d0f8b54872fc8a4a33b73e6c1f
-
SHA1
a06aaa68f5790c08870e9bcee0ef12bb81ac039d
-
SHA256
49d58127fbc1188fcb3072508a3725d185aaf45750dea2c42a2b9dd9af5f8dff
-
SHA512
2bedd6a739fe8f1fbd2b5af5ad49ac60b6e1dad7183de70b35cd8a26ba90b672783d8662a4eb699866a066706001dceaeb27cb24abab69a11997803c7a20cedb
-
SSDEEP
1536:oQULgnX0YLnGeqFJTnmJV0Z1yhSUeNGe15oZhGHdGWhd1VK:AEnEonGLJSD0HyhZe/5ofWrr
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource aff1e0d0f8b54872fc8a4a33b73e6c1f_JaffaCakes118
Files
-
aff1e0d0f8b54872fc8a4a33b73e6c1f_JaffaCakes118.exe windows:4 windows x86 arch:x86
de55977460e41e431132a7a5431b130b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WriteFile
CreateFileA
GetTickCount
SetComputerNameA
ReadFile
GetStartupInfoA
GetSystemInfo
OpenProcess
CreateDirectoryA
RemoveDirectoryA
MoveFileA
WideCharToMultiByte
TerminateProcess
CreatePipe
PeekNamedPipe
HeapFree
GetProcessHeap
HeapAlloc
LoadLibraryA
FreeLibrary
GetProcAddress
FileTimeToLocalFileTime
FileTimeToSystemTime
GetDriveTypeA
GetDiskFreeSpaceA
GlobalMemoryStatus
GetProcessVersion
GetVersionExA
GetModuleHandleA
GetComputerNameA
GetSystemDirectoryA
SetThreadPriority
TerminateThread
CreateToolhelp32Snapshot
Process32First
Process32Next
WinExec
MultiByteToWideChar
CreateProcessA
ExitThread
CreateThread
GetLastError
FormatMessageA
DeleteFileA
GetWindowsDirectoryA
GetCurrentProcess
FindClose
GetModuleFileNameA
Sleep
CloseHandle
CopyFileA
FindNextFileA
FindFirstFileA
ExitProcess
SetHandleCount
SetCurrentDirectoryA
SetEndOfFile
LCMapStringW
LCMapStringA
SetEnvironmentVariableA
GetOEMCP
GetACP
CompareStringW
CompareStringA
GetCPInfo
FlushFileBuffers
SetStdHandle
GetStringTypeW
GetStringTypeA
SetFilePointer
RtlUnwind
GetFileType
GetStdHandle
GetCurrentDirectoryA
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetVersion
GetCommandLineA
GetLocalTime
GetSystemTime
GetTimeZoneInformation
GetFullPathNameA
user32
MessageBoxA
OpenClipboard
SetCursorPos
CloseClipboard
ExitWindowsEx
GetClipboardData
wsprintfA
GetWindowTextA
IsWindowVisible
FindWindowA
ShowWindow
GetDesktopWindow
GetSystemMetrics
keybd_event
UnhookWindowsHookEx
GetWindow
SetWindowsHookExA
gdi32
GetDeviceCaps
CreateCompatibleDC
DeleteDC
CreateDIBSection
SelectObject
BitBlt
GetDIBColorTable
DeleteObject
CreateDCA
advapi32
RegisterEventSourceA
ClearEventLogA
OpenEventLogA
ReadEventLogA
GetUserNameA
ReportEventA
DeregisterEventSource
RegOpenKeyExA
RegSetValueExA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
StartServiceA
RegQueryValueExA
RegDeleteKeyA
RegCreateKeyExA
RegDeleteValueA
CloseServiceHandle
EnumServicesStatusA
OpenSCManagerA
QueryServiceStatus
CloseEventLog
OpenServiceA
ControlService
DeleteService
GetSidSubAuthority
GetSidSubAuthorityCount
GetSidIdentifierAuthority
IsValidSid
LookupAccountNameA
wsock32
send
WSACleanup
connect
socket
gethostbyname
closesocket
WSAStartup
listen
bind
accept
recv
htons
wininet
FtpGetFileA
InternetOpenA
InternetCloseHandle
InternetConnectA
InternetOpenUrlA
FtpPutFileA
InternetReadFile
netapi32
NetServerEnum
NetApiBufferFree
NetShareEnum
NetShareAdd
NetShareDel
NetLocalGroupEnum
NetLocalGroupGetMembers
NetUserGetInfo
Sections
.text Size: 68KB - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 36KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ