Static task
static1
Behavioral task
behavioral1
Sample
b29d0ff04193417ac464999174f85729_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
b29d0ff04193417ac464999174f85729_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
b29d0ff04193417ac464999174f85729_JaffaCakes118
-
Size
72KB
-
MD5
b29d0ff04193417ac464999174f85729
-
SHA1
3c3d4ba874b2e79ef504e409fad606e1aa769126
-
SHA256
c183cea63a437594d132059b7f75ec48ce0b6734993996943cb3e4ad6d471105
-
SHA512
ca9517dd8530b224575bfb9d02a03c38f74adf6c18af746f2f25a64f9c2780e307c1bf4668c1962fbddef8dae46c73d874fb1694baaabc27458353e5a3e65115
-
SSDEEP
1536:I6lwmQE6mDPFyxikQAMh4xrPFPsJc3SA:9lmxoAeCPFPsJc3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b29d0ff04193417ac464999174f85729_JaffaCakes118
Files
-
b29d0ff04193417ac464999174f85729_JaffaCakes118.exe windows:4 windows x86 arch:x86
728f4da16ff95612e015a54c32899f35
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetOverlappedResult
SetSystemTime
GetStringTypeW
GetStringTypeA
FlushFileBuffers
SetFilePointer
LCMapStringW
LCMapStringA
WideCharToMultiByte
LoadLibraryA
HeapSize
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
LocalAlloc
GetEnvironmentVariableA
GetModuleFileNameA
GetModuleHandleA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
GetCommandLineA
GetEnvironmentStrings
GetEnvironmentStringsW
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
MultiByteToWideChar
RtlUnwind
ExitProcess
GetVersion
CreateEventW
GetLocalTime
GetDateFormatW
GetTimeFormatW
LoadLibraryW
SetStdHandle
GetProcAddress
FreeLibrary
SetConsoleCtrlHandler
GetModuleFileNameW
GetCommandLineW
OpenProcess
FormatMessageW
lstrcpyA
FormatMessageA
lstrcatA
LocalFree
CreateNamedPipeW
ConnectNamedPipe
ReadFile
SetErrorMode
Sleep
TerminateProcess
WaitNamedPipeW
CreateFileW
GetCurrentProcess
lstrcatW
lstrlenW
lstrcpyW
GetCurrentThread
CreateThread
GetProcessHeap
GetLastError
HeapAlloc
HeapFree
GetEnvironmentVariableW
GetSystemDirectoryW
SetLastError
SetEnvironmentVariableW
CloseHandle
lstrlenA
WriteFile
WaitForSingleObject
DisconnectNamedPipe
GetVersionExA
ExitThread
user32
GetWindow
IsWindowVisible
SendMessageTimeoutW
EnumWindows
GetWindowTextW
GetWindowThreadProcessId
CharLowerW
wsprintfA
GetParent
GetWindowRect
GetClientRect
ClientToScreen
MoveWindow
SetWindowPos
ExitWindowsEx
KillTimer
EndDialog
GetDlgItemTextW
SetDlgItemTextW
GetDlgItem
EnableWindow
SetTimer
LoadIconW
SendDlgItemMessageW
UpdateWindow
PostMessageW
GetDesktopWindow
DialogBoxParamW
SetUserObjectSecurity
GetUserObjectSecurity
OpenWindowStationW
SetProcessWindowStation
OpenDesktopW
CloseWindowStation
CloseDesktop
wsprintfW
advapi32
OpenSCManagerW
CloseServiceHandle
RegisterEventSourceW
ReportEventW
DeregisterEventSource
SetServiceStatus
RegisterServiceCtrlHandlerW
StartServiceCtrlDispatcherW
GetSidLengthRequired
InitializeSid
LogonUserA
ImpersonateLoggedOnUser
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
GetSidSubAuthority
ImpersonateNamedPipeClient
OpenThreadToken
DuplicateTokenEx
LogonUserW
RevertToSelf
InitializeSecurityDescriptor
GetSecurityDescriptorDacl
GetAclInformation
InitializeAcl
AddAce
GetAce
AddAccessAllowedAce
SetSecurityDescriptorDacl
GetTokenInformation
GetLengthSid
CopySid
IsValidSid
CreateProcessAsUserW
DeleteService
QueryServiceStatus
ControlService
OpenServiceW
CreateServiceW
shell32
CommandLineToArgvW
psapi
EnumProcesses
EnumProcessModules
GetModuleBaseNameW
Sections
.text Size: 40KB - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ