Static task
static1
Behavioral task
behavioral1
Sample
b5a5098f59753372a99fd0998009117c_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
b5a5098f59753372a99fd0998009117c_JaffaCakes118
-
Size
1.5MB
-
MD5
b5a5098f59753372a99fd0998009117c
-
SHA1
32eb6fcfea230ee499d7f25d65df1ab3fa52d4cf
-
SHA256
1552861973aa487aa929e3ad48248f11f73cec22c55007783744e411e6b50f3c
-
SHA512
439cbdbbd2e15ef1bfc442926b55f588bcab9c2b05fb10c01f66f70b64b6031f441c68ffbac1ece2f093514ae6d4383cdce53328f2dc75d5c83579f8bd985d0d
-
SSDEEP
49152:+DM6qx/tlNVQg0eTHeYYDyHx4h7DASmkhlKT:2M3frVB0ezeYN4ZD3lKT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b5a5098f59753372a99fd0998009117c_JaffaCakes118
Files
-
b5a5098f59753372a99fd0998009117c_JaffaCakes118.exe windows:4 windows x86 arch:x86
0d96fa193cef33907395deb30373232a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
CreateServiceA
FreeSid
GetSecurityDescriptorControl
OpenSCManagerA
QueryServiceStatus
RegDeleteValueA
RegSetValueExA
SetServiceStatus
kernel32
CompareStringA
CreateEventA
CreateMutexA
CreateThread
CreateToolhelp32Snapshot
DisableThreadLibraryCalls
EnumSystemLocalesA
ExitProcess
FileTimeToLocalFileTime
FindFirstFileA
FreeLibrary
GetConsoleOutputCP
GetCurrentDirectoryA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetEnvironmentStringsA
GetExitCodeProcess
GetFileSize
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetPrivateProfileSectionNamesA
GetProcAddress
GetProcessHeap
GetStdHandle
GetSystemDirectoryA
GetSystemTime
GetSystemTimeAsFileTime
GetVersionExA
GetWindowsDirectoryA
GlobalAlloc
GlobalFree
GlobalHandle
HeapSize
InitializeCriticalSection
InterlockedCompareExchange
InterlockedIncrement
IsBadWritePtr
IsDebuggerPresent
IsValidCodePage
LCMapStringA
LeaveCriticalSection
LoadLibraryExA
LocalAlloc
LockResource
Module32First
OutputDebugStringA
QueryPerformanceCounter
RaiseException
ReadFile
ReadProcessMemory
ResetEvent
ResumeThread
SearchPathA
SetErrorMode
SetEvent
SetFileTime
SetHandleCount
SetStdHandle
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
TerminateProcess
UnhandledExceptionFilter
UnmapViewOfFile
VirtualAlloc
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
WriteConsoleA
WritePrivateProfileStringA
lstrcmpA
lstrcmpiA
lstrcpynA
user32
CallNextHookEx
CharLowerA
CharNextA
CharPrevA
CharUpperA
CreateWindowExA
DefWindowProcA
DestroyWindow
EnableMenuItem
EqualRect
GetCapture
GetDlgItemTextA
GetMenuItemCount
GetSubMenu
GetWindowLongA
IntersectRect
MessageBoxA
PeekMessageA
PostMessageA
PtInRect
RegisterWindowMessageA
SendDlgItemMessageA
SendMessageA
SetWindowTextA
TrackPopupMenu
TranslateMessage
UnregisterClassA
wsprintfA
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
Sections
.text Size: 26KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.DATA Size: 1.4MB - Virtual size: 20.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.edata Size: 15KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 63KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ