Static task
static1
Behavioral task
behavioral1
Sample
b7c98568e4f480bb940f00977655e40e_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
b7c98568e4f480bb940f00977655e40e_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
b7c98568e4f480bb940f00977655e40e_JaffaCakes118
-
Size
268KB
-
MD5
b7c98568e4f480bb940f00977655e40e
-
SHA1
10b4571509713c984fffb4161ee6e79f2ad0172d
-
SHA256
7ffa00e793ed996f981e66f727150b5762d97ee3102d31f98a75f70e5762298f
-
SHA512
056e3e19ac2cb06d3ca9014c1f8c4e9974cf5dad16239d96c15d34e31043e1b6c3a56bfdd387e0450611c224adff3b1c392a83c40ffbdc2a495e63a58ca2acad
-
SSDEEP
6144:N/lYbbxZc2ArOLbddIo0mwRTvDZ9CFyfgdEOxC8ddT316HnZgo:mVRf2NvDvCqgfCYdTlMr
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b7c98568e4f480bb940f00977655e40e_JaffaCakes118
Files
-
b7c98568e4f480bb940f00977655e40e_JaffaCakes118.exe windows:4 windows x86 arch:x86
c0ec86e68f06fbbdb7ad3b963a9d60d6
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
OpenEventA
CreateProcessA
CreateEventA
SetLastError
DuplicateHandle
GetCurrentProcessId
LocalFree
LocalAlloc
Sleep
GetVersionExA
GetCurrentThreadId
HeapDestroy
DisableThreadLibraryCalls
InterlockedExchange
InterlockedCompareExchange
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
LeaveCriticalSection
GetFullPathNameW
lstrcpyW
LoadLibraryW
WaitForSingleObject
GetProcAddress
GetFileAttributesW
GetVersion
GetModuleFileNameW
UnmapViewOfFile
DeleteFileW
CreateFileW
WriteFile
SetEvent
OpenEventW
CopyFileW
ReleaseMutex
HeapCreate
lstrcmpiW
ExpandEnvironmentStringsW
GetStringTypeExW
GetTimeFormatW
GetVersionExW
GetDateFormatW
MoveFileExW
GetFileType
OutputDebugStringW
lstrcatW
CloseHandle
GetCurrentThread
GetCurrentProcess
GetLastError
lstrcmpiA
GetModuleFileNameA
GetModuleHandleA
lstrlenW
lstrlenA
DeleteCriticalSection
GetStartupInfoA
InitializeCriticalSection
InterlockedDecrement
FreeLibrary
InterlockedIncrement
HeapFree
GetProcessHeap
HeapAlloc
LoadLibraryA
WideCharToMultiByte
GlobalFree
GetCommandLineA
VirtualProtect
GetModuleHandleW
GlobalAlloc
user32
LoadStringA
SetCursor
GetWindowTextW
SetWindowLongW
SetFocus
LoadCursorW
wvsprintfW
MessageBeep
wsprintfW
GetDlgItemInt
GetWindowLongW
LoadIconW
ShowWindow
GetFocus
SetDlgItemInt
LoadStringW
GetParent
SendMessageW
GetDlgItemTextW
SetDlgItemTextW
IsDlgButtonChecked
GetDlgItem
EnableWindow
SendDlgItemMessageW
SetActiveWindow
CheckDlgButton
SetWindowTextW
advapi32
CloseServiceHandle
AllocateAndInitializeSid
QueryServiceStatus
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
RegDeleteKeyA
RegEnumKeyExA
OpenProcessToken
GetTokenInformation
EqualSid
OpenServiceW
QueryServiceConfigA
OpenSCManagerW
RegCreateKeyExW
RegSetValueExW
MakeSelfRelativeSD
RegQueryValueExW
RegOpenKeyExW
RegOpenKeyW
RegDeleteKeyW
FreeSid
ole32
StringFromCLSID
CoTaskMemFree
StringFromGUID2
rpcrt4
RpcStringFreeA
RpcBindingFree
NdrClientCall2
RpcStringBindingComposeA
RpcBindingFromStringBindingA
msvcr71
__set_app_type
__p__fmode
__p__commode
__setusermatherr
__getmainargs
_acmdln
exit
_cexit
_ismbblead
_exit
_c_exit
_initterm
malloc
_adjust_fdiv
wcscat
wcslen
wcscpy
_snwprintf
wcsrchr
wcscmp
_vsnwprintf
wcsncpy
_wcsicmp
swprintf
_amsg_exit
_XcptFilter
free
_controlfp
_onexit
__dllonexit
_except_handler3
Sections
.text Size: 33KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 228KB - Virtual size: 453KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ