Static task
static1
Behavioral task
behavioral1
Sample
b4297ee135abc88afe0303c92557a7a9_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
b4297ee135abc88afe0303c92557a7a9_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
b4297ee135abc88afe0303c92557a7a9_JaffaCakes118
-
Size
166KB
-
MD5
b4297ee135abc88afe0303c92557a7a9
-
SHA1
c59eeacca15714412046d8f44186e60c1727dd68
-
SHA256
680863e3b521e9df934220e78ba610cd3d462054e51d0aa7c9f9ffa2191ccd37
-
SHA512
f2d7da3e99641b73346dda97d34edae8f6cdef30a4ebfbac2607f3123c4ece62f802876f031a880f91648a860abd64dae231730161d2f28e2b1941126074dddc
-
SSDEEP
3072:JoXMttz7nAe9Tn18W4jJk1Gk8+OAn9GdzqwwmwpS2bWpLu9V2DO2z7UNdY9oXDAO:Jo8tVjAeXRx1o+j9GdyS/YQDO2zP9oXV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b4297ee135abc88afe0303c92557a7a9_JaffaCakes118
Files
-
b4297ee135abc88afe0303c92557a7a9_JaffaCakes118.exe windows:4 windows x86 arch:x86
aa9e88fcd6c3871b40ccb7867542a69c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_DEBUG_STRIPPED
Imports
oleacc
LresultFromObject
CreateStdAccessibleObject
gdi32
GetDeviceCaps
CreateFontIndirectW
DeleteObject
version
VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW
ole32
CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
CoUninitialize
CoCreateInstance
CoInitialize
kernel32
lstrcmpA
GetCurrentProcessId
LoadResource
SetStdHandle
InterlockedExchange
TlsAlloc
GetModuleFileNameW
CreateFileA
WriteConsoleInputVDMA
WaitForSingleObject
FlushFileBuffers
GetFileAttributesW
SetFilePointer
GetConsoleCP
LockResource
SizeofResource
WriteConsoleA
GetStringTypeA
HeapReAlloc
LeaveCriticalSection
CreateFileMappingW
CloseHandle
LocalFree
GetConsoleOutputCP
Sleep
GetConsoleMode
GetProcAddress
FreeLibrary
LCMapStringA
GetFileSize
GetACP
WriteConsoleW
GetCommandLineW
WriteFile
TlsFree
GetStringTypeW
InterlockedCompareExchange
QueryPerformanceCounter
GetEnvironmentStringsW
GetProcessHandleCount
GetCurrentProcess
HeapDestroy
LoadLibraryW
VirtualFree
ExitProcess
MulDiv
GetVersionExW
GetCurrentThreadId
EnumResourceNamesA
GetThreadLocale
GetSystemTimeAsFileTime
DeleteCriticalSection
GetStartupInfoA
GetEnvironmentStrings
DeleteFileW
HeapFree
GetFileType
GetCPInfo
IsProcessorFeaturePresent
LocalAlloc
GetTickCount
GetLocaleInfoA
FindResourceW
CreateSemaphoreW
HeapCreate
GetSystemDirectoryW
GetVersion
lstrcmpiW
LoadLibraryExW
CopyFileW
GetModuleFileNameA
GetModuleHandleW
IsDebuggerPresent
GetProcessHeap
FlushInstructionCache
HeapAlloc
WideCharToMultiByte
VirtualAlloc
SetLastError
InitializeCriticalSection
GetStartupInfoW
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetOEMCP
HeapSize
SetUnhandledExceptionFilter
InterlockedDecrement
UnhandledExceptionFilter
GetDriveTypeW
lstrlenA
InterlockedIncrement
CreateFileW
RtlUnwind
GetModuleHandleA
RaiseException
ReadFile
CreateProcessW
LCMapStringW
TlsGetValue
GetLastError
WritePrivateProfileSectionW
GetStdHandle
SetHandleCount
GetVersionExA
GetCommandLineA
TlsSetValue
LoadLibraryA
lstrlenW
shell32
SHGetSpecialFolderLocation
ShellExecuteW
SHGetPathFromIDListW
user32
TranslateMessage
GetWindowTextLengthW
PeekMessageW
LoadCursorW
GetWindow
SetWindowPos
GetWindowInfo
SetDlgItemTextW
DispatchMessageW
GetDlgItem
GetDC
DestroyWindow
RegisterClassExW
SystemParametersInfoW
GetParent
SetCapture
EndPaint
BeginPaint
GetClientRect
GetClassInfoExW
GetDlgItemTextW
SetWindowTextW
MessageBoxW
MapWindowPoints
CreateWindowExW
GetWindowRect
EndDialog
Sections
.text Size: 89KB - Virtual size: 88KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 71KB - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idive Size: 1024B - Virtual size: 376KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ