Static task
static1
Behavioral task
behavioral1
Sample
b40278658c74c98dc303da4eb6fbd838_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
b40278658c74c98dc303da4eb6fbd838_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
b40278658c74c98dc303da4eb6fbd838_JaffaCakes118
-
Size
389KB
-
MD5
b40278658c74c98dc303da4eb6fbd838
-
SHA1
32cd760be4d9bca8612236f802e699cf7267b4d5
-
SHA256
4744f60445f39850f834c20b68585d747d509e812d307974d9a75f8a1b644ef5
-
SHA512
e1889e945465476defe67fed28a1eef8d03639b627a9effdd95e657915797c15f9126d6841ee6c28c1920a66ed236935a1c8ed9e170fa3815e7913e841ed7cec
-
SSDEEP
6144:a/j+9noP+RN8T2z9lwr1R6XdU9qRRN8T2z9lwr1R6XdU9q23ts1m8QXLbyOg4H:SC9k+RN8T2v2sXdpRN8T2v2sXd41M
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b40278658c74c98dc303da4eb6fbd838_JaffaCakes118
Files
-
b40278658c74c98dc303da4eb6fbd838_JaffaCakes118.exe windows:6 windows x64 arch:x64
b7522e1783b3ef674433699473b9f145
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
advapi32
TraceEvent
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsA
UnregisterTraceGuids
RegCreateKeyExW
RegOpenKeyExW
RegSetValueW
RegCloseKey
RegSetValueExW
RegQueryValueExW
kernel32
GetProcAddress
lstrlenW
LoadLibraryA
FreeLibrary
ExpandEnvironmentStringsW
CreateProcessW
WaitForSingleObject
GetExitCodeProcess
CloseHandle
CreateMutexW
ReleaseMutex
GetFileAttributesA
GetFileAttributesW
GetModuleHandleW
GetCurrentProcess
HeapSetInformation
SetConsoleCtrlHandler
GetVersionExA
SetFileAttributesW
DeleteFileW
GetShortPathNameW
GetCurrentDirectoryW
SetCurrentDirectoryW
FindFirstFileW
FindNextFileW
FindClose
FindFirstFileExW
CreateDirectoryW
GetStartupInfoW
Sleep
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
GetLastError
GetModuleHandleA
SetUnhandledExceptionFilter
user32
UnhookWindowsHookEx
SetForegroundWindow
SendMessageTimeoutA
GetParent
GetLastActivePopup
GetPropW
SetWindowsHookExA
CallNextHookEx
AllowSetForegroundWindow
GetWindowThreadProcessId
FindWindowW
SendMessageW
GetGUIThreadInfo
IsDialogMessageW
SetPropW
IsChild
MessageBoxW
LoadStringW
msvcrt
memset
_vsnwprintf
?terminate@@YAXXZ
__set_app_type
_fmode
_commode
__setusermatherr
_amsg_exit
_initterm
_wcmdln
exit
_cexit
_exit
_XcptFilter
__C_specific_handler
__wgetmainargs
msoert2
CopyRegistry
comctl32
ord344
ole32
OleInitialize
CoFreeUnusedLibraries
CoCreateInstance
CoTaskMemFree
CoUninitialize
CoInitializeEx
CoFreeAllLibraries
OleUninitialize
CoFreeUnusedLibrariesEx
shell32
SHCreateItemFromParsingName
SHGetSpecialFolderPathW
SHChangeNotify
SHGetSpecialFolderLocation
shlwapi
StrCmpW
PathAddExtensionW
ord158
PathRemoveBlanksW
PathCombineW
SHRegGetBoolUSValueA
SHDeleteKeyW
PathRemoveFileSpecW
PathAppendW
ord433
StrStrIW
SHRegGetValueA
PathFindFileNameW
StrCmpNIW
SHGetValueW
StrCmpIW
SHRegGetValueW
SHSetValueW
ntdll
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
Sections
.text Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1024B - Virtual size: 588B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 17B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 359KB - Virtual size: 358KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 372B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ