Static task
static1
Behavioral task
behavioral1
Sample
b95cfc3d92c32175179eb7ec4adba24f_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
b95cfc3d92c32175179eb7ec4adba24f_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
b95cfc3d92c32175179eb7ec4adba24f_JaffaCakes118
-
Size
54KB
-
MD5
b95cfc3d92c32175179eb7ec4adba24f
-
SHA1
c19f0b8bc6b93ee6a3177ba9abd6b2e9174d90c2
-
SHA256
4375bb87741370b90873be36f2d62055b22fbce3153fb560aa41cafbb5263c3a
-
SHA512
6678ae99f408e1ef066ac2c65d3b888050b3e90662533acfa29ebbcbec9375b5ea1dbb5cacaa6738101d25b95235578d7393d750509b3c8ec7e8327e7af7f33d
-
SSDEEP
1536:JWiXi2iS/A1YY6SkTXJT+R3IVkiG9qvaCn3eEgHf/:JWiSVGzZ+R4VkQv5tgHf/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b95cfc3d92c32175179eb7ec4adba24f_JaffaCakes118
Files
-
b95cfc3d92c32175179eb7ec4adba24f_JaffaCakes118.exe windows:4 windows x86 arch:x86
2930719d2f0620f983e87fd7184cd575
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
AdjustTokenPrivileges
AllocateAndInitializeSid
GetSecurityDescriptorControl
GetUserNameA
OpenSCManagerA
RegDeleteKeyA
RegEnumKeyExA
RegQueryInfoKeyA
SetSecurityDescriptorDacl
UnlockServiceDatabase
kernel32
CloseHandle
CopyFileA
CreateEventA
CreateFileA
DeleteAtom
DeleteCriticalSection
DisableThreadLibraryCalls
ExitProcess
ExitThread
FileTimeToLocalFileTime
FindClose
FindNextFileA
FreeEnvironmentStringsA
FreeLibrary
GetCommandLineA
GetConsoleMode
GetCurrentThreadId
GetDriveTypeA
GetEnvironmentStringsA
GetEnvironmentVariableA
GetLastError
GetLocalTime
GetModuleFileNameA
GetModuleHandleA
GetPrivateProfileStringA
GetProcessHeap
GetStdHandle
GetStringTypeA
GetSystemInfo
GetSystemTimeAsFileTime
GetTempFileNameA
GetTempPathA
GetThreadTimes
GetTimeFormatA
GetTimeZoneInformation
GetVersionExA
GlobalAlloc
GlobalReAlloc
GlobalUnlock
HeapAlloc
HeapDestroy
HeapSize
InitializeCriticalSection
InterlockedCompareExchange
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
IsBadWritePtr
IsDebuggerPresent
IsValidCodePage
IsValidLocale
LeaveCriticalSection
LoadResource
LocalFree
Module32Next
MoveFileExA
MultiByteToWideChar
OpenProcess
QueryPerformanceCounter
ReadFile
ReadProcessMemory
SearchPathA
SetEndOfFile
SetEnvironmentVariableA
SetFilePointer
SetFileTime
SetPriorityClass
SetStdHandle
SizeofResource
SuspendThread
TerminateProcess
TlsSetValue
UnhandledExceptionFilter
UnmapViewOfFile
VirtualFree
WriteFile
lstrcmpiA
lstrcpyA
user32
CharNextA
CheckMenuItem
CreateWindowExA
DialogBoxParamA
DispatchMessageA
FindWindowA
GetActiveWindow
GetClientRect
GetDlgItemTextA
GetFocus
GetWindowLongA
GetWindowTextA
GetWindowThreadProcessId
IntersectRect
IsWindow
MessageBoxA
MsgWaitForMultipleObjects
PeekMessageA
PostMessageA
RegisterClassA
RegisterClipboardFormatA
SendDlgItemMessageA
SetDlgItemTextA
SetForegroundWindow
SetWindowTextA
TranslateMessage
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
Sections
.text Size: 19KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.CRT Size: 13KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.edata Size: 15KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ