Static task
static1
Behavioral task
behavioral1
Sample
b7195c93ec0c51006d830bc40acced23_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
b7195c93ec0c51006d830bc40acced23_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
b7195c93ec0c51006d830bc40acced23_JaffaCakes118
-
Size
163KB
-
MD5
b7195c93ec0c51006d830bc40acced23
-
SHA1
c1f38f369014bdc8b57e973418dc3c871aebbe47
-
SHA256
9c5bb99e6855c42fda49ec9f83e350d4ba7e9b696d1050d761d6bc7974b04b4d
-
SHA512
3db34144505fe7a01f6725f442c05296f1bfe834c0a557f90b284f205852f023cdca1725f05fad598037e583c7c66b50c2d98525aba0bf517b54f861e8a0a03b
-
SSDEEP
3072:5X8B8R2dlXhLn+5KqpXLui3MQCwR74mZaoIrXdAUmO0iXRUJjPpEANu57sO1ydjB:3R8hlnwrt9RdZaoIrXqR0hojxEANu57a
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b7195c93ec0c51006d830bc40acced23_JaffaCakes118
Files
-
b7195c93ec0c51006d830bc40acced23_JaffaCakes118.exe windows:4 windows x86 arch:x86
91c55587490f29d4fe305ebabf492ba5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
AdjustTokenPrivileges
ChangeServiceConfigA
DeleteService
FreeSid
GetSecurityDescriptorControl
GetTokenInformation
InitializeSecurityDescriptor
LookupAccountSidA
OpenProcessToken
RegQueryInfoKeyA
RegQueryValueA
SetServiceStatus
kernel32
CopyFileA
CreateFileA
CreateThread
CreateToolhelp32Snapshot
DeleteAtom
DuplicateHandle
ExitProcess
ExpandEnvironmentStringsA
FindFirstFileA
FreeLibrary
GetACP
GetConsoleCP
GetCurrentProcess
GetCurrentThreadId
GetDateFormatA
GetDriveTypeA
GetEnvironmentStringsA
GetFileAttributesA
GetFileSize
GetFileTime
GetFullPathNameA
GetLastError
GetLocalTime
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetProcessHeap
GetShortPathNameA
GetStartupInfoA
GetStdHandle
GetStringTypeA
GetSystemDirectoryA
GetTempPathA
GetThreadLocale
GetVersion
GetVersionExA
GlobalAlloc
GlobalFree
GlobalLock
GlobalReAlloc
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSection
InterlockedDecrement
IsBadCodePtr
IsBadReadPtr
LCMapStringA
LeaveCriticalSection
LoadLibraryA
LoadResource
LocalFree
MoveFileA
OpenProcess
OutputDebugStringA
QueryPerformanceCounter
ReadProcessMemory
RemoveDirectoryA
ResetEvent
ResumeThread
SetEnvironmentVariableA
SetErrorMode
SetHandleCount
SetLastError
SetPriorityClass
SetUnhandledExceptionFilter
Sleep
TlsGetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
WaitForSingleObject
WideCharToMultiByte
WritePrivateProfileStringA
lstrcmpA
lstrcmpiA
lstrcpynA
lstrlenA
user32
CallWindowProcA
CharPrevA
CharUpperA
CheckRadioButton
EnableWindow
EnumChildWindows
GetMessageA
GetSystemMetrics
GetWindow
GetWindowTextLengthA
InflateRect
LoadBitmapA
LoadIconA
LoadStringA
MessageBoxA
PeekMessageA
PostQuitMessage
RegisterClassExA
ScreenToClient
SendDlgItemMessageA
SetFocus
SetRect
SetTimer
SetWindowPos
SystemParametersInfoA
wsprintfA
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
Sections
.text Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.DATA Size: 115KB - Virtual size: 248KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 15KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ