Static task
static1
Behavioral task
behavioral1
Sample
b5a2da4800f7007fd3778890b0e47942_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
b5a2da4800f7007fd3778890b0e47942_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
b5a2da4800f7007fd3778890b0e47942_JaffaCakes118
-
Size
504KB
-
MD5
b5a2da4800f7007fd3778890b0e47942
-
SHA1
a58e78d4d92aa2e1430a3b60b050f1d71f8ccb35
-
SHA256
66e21e7f506c9d45d9ef354c38f70a478d65e0a9c0fe57d762a6ac41dbb9e60e
-
SHA512
9ae4b50c2941a5acefa5f3e1ce657f59da70c396ad7a41e89abb53cfef6a26d82b4efb8b5954bbba14186fa4dfa82fbb5be1ad73f9b355374b2f30ef28bce8ee
-
SSDEEP
12288:R8dAGBz74U7SctpYzGYkK7ZRYOx+DprSjwIaNWJWpj0:Rg/IU7S4lUTYgKpreaEJWpj0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b5a2da4800f7007fd3778890b0e47942_JaffaCakes118
Files
-
b5a2da4800f7007fd3778890b0e47942_JaffaCakes118.exe windows:4 windows x86 arch:x86
6f1b46cae2c24e39b55a14b18c8d709a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegConnectRegistryW
RegSaveKeyW
RegEnumValueW
ReportEventA
CryptGetProvParam
CryptReleaseContext
LookupPrivilegeDisplayNameW
RegEnumKeyW
kernel32
ReadFile
CloseHandle
CompareStringA
GetStdHandle
HeapDestroy
SetLastError
HeapReAlloc
lstrcatW
GetModuleFileNameA
TlsFree
HeapFree
GetCurrentProcess
GetStartupInfoW
TlsSetValue
HeapAlloc
GetLastError
InterlockedDecrement
UnhandledExceptionFilter
GetConsoleCursorInfo
GetStringTypeW
GetCommandLineW
GetProcAddress
GetSystemTimeAsFileTime
AddAtomA
UnmapViewOfFile
WideCharToMultiByte
SetFilePointer
MoveFileW
MultiByteToWideChar
LCMapStringA
lstrcpyW
FlushFileBuffers
GetCurrentThread
GetLocalTime
CreateMutexA
ExitProcess
GetFullPathNameA
InterlockedIncrement
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetStringTypeA
EnterCriticalSection
OpenMutexA
WriteFile
IsBadWritePtr
LCMapStringW
DeleteCriticalSection
GetTickCount
TerminateProcess
SetThreadContext
GetCPInfo
GetCommandLineA
GetCurrentProcessId
VirtualFree
FindFirstFileW
SetStdHandle
InterlockedExchange
GetModuleFileNameW
SetHandleCount
GetVersion
HeapCreate
GetModuleHandleA
GetCurrentThreadId
RtlUnwind
GetStartupInfoA
TlsAlloc
FindResourceExA
LoadLibraryA
TlsGetValue
LeaveCriticalSection
CompareStringW
InitializeCriticalSection
GetEnvironmentStringsW
GetTimeZoneInformation
GetEnvironmentStrings
VirtualQuery
GetSystemTime
VirtualAlloc
FreeEnvironmentStringsA
GetThreadContext
GetFileType
QueryPerformanceCounter
wininet
InternetAttemptConnect
HttpOpenRequestW
CreateUrlCacheEntryA
ShowX509EncodedCertificate
InternetCrackUrlW
InternetTimeFromSystemTimeW
FreeUrlCacheSpaceW
FtpSetCurrentDirectoryW
gdi32
GetTextColor
GetKerningPairsA
SetBitmapBits
FillPath
comdlg32
ChooseColorW
GetOpenFileNameW
PrintDlgA
user32
SetScrollInfo
RegisterClassA
GetUpdateRgn
ExitWindowsEx
GetKeyboardType
ChangeDisplaySettingsW
HideCaret
LoadCursorW
RegisterClassExA
WinHelpW
DispatchMessageA
GetMenuItemID
InSendMessage
comctl32
InitCommonControlsEx
Sections
.text Size: 182KB - Virtual size: 182KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 314KB - Virtual size: 313KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ