Static task
static1
Behavioral task
behavioral1
Sample
b86be4d48d2c800df65b49e37eb50079_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
b86be4d48d2c800df65b49e37eb50079_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
b86be4d48d2c800df65b49e37eb50079_JaffaCakes118
-
Size
557KB
-
MD5
b86be4d48d2c800df65b49e37eb50079
-
SHA1
c05404f89264f2020b8020c6c37b373bd2d60878
-
SHA256
c022aec3d4e4a7ed7bf7677561c662a5ca493d0bb9342c4d82cfbb3ddef1213f
-
SHA512
708b8e5a43579ecc413cdedbc8a402611ffe72a0ec728d6c27edd7ed8aa2b1a20abdce591185232beb5c69c8353dbacd58a516807f6b7b09f65680a3ed42c8c5
-
SSDEEP
12288:aduh7HkR2mTtNjeLtqnW9++qpDBNhhmehKbafjnEHwuw:rHeJTtNeLtqklqpDB/KbarnAwu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b86be4d48d2c800df65b49e37eb50079_JaffaCakes118
Files
-
b86be4d48d2c800df65b49e37eb50079_JaffaCakes118.exe windows:4 windows x86 arch:x86
3152344a979597f483c77606e2665c00
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetStdHandle
UnhandledExceptionFilter
InterlockedIncrement
GetCPInfo
InitializeCriticalSection
HeapReAlloc
LCMapStringW
InterlockedExchange
EnterCriticalSection
TlsFree
EnumResourceNamesA
LCMapStringA
TlsAlloc
FileTimeToLocalFileTime
WriteConsoleA
GetUserDefaultLCID
TerminateProcess
GetACP
GetStringTypeA
GetCurrentThread
HeapAlloc
WriteFile
CompareStringW
CloseHandle
GetEnvironmentStrings
OpenMutexA
VirtualLock
GetLocaleInfoA
GetSystemTimeAsFileTime
GetStringTypeW
FindResourceExW
CommConfigDialogA
IsValidLocale
GetCommandLineA
GetDiskFreeSpaceW
IsValidCodePage
GetOEMCP
GetTimeZoneInformation
GetEnvironmentStringsW
ReadFile
FreeEnvironmentStringsW
GetStdHandle
GetDateFormatA
RtlUnwind
GetLocaleInfoW
GetTimeFormatA
SetLastError
GetModuleFileNameA
GetCurrentProcess
GetVersionExA
GetSystemInfo
FlushFileBuffers
CompareStringA
LeaveCriticalSection
SetEnvironmentVariableA
MultiByteToWideChar
SetFilePointer
VirtualProtect
TlsGetValue
HeapDestroy
SetLocaleInfoW
EnumSystemCodePagesA
GetStartupInfoA
FreeEnvironmentStringsA
IsBadWritePtr
EnumSystemLocalesA
GetFullPathNameA
DuplicateHandle
VirtualFree
HeapFree
VirtualQuery
VirtualAlloc
CreateMutexA
HeapSize
GetShortPathNameW
WideCharToMultiByte
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
GetTickCount
LoadLibraryA
ResumeThread
HeapCreate
DeleteCriticalSection
lstrcatA
GetFileType
GetProcessAffinityMask
TlsSetValue
GetLastError
GetModuleHandleA
GetProcAddress
SetHandleCount
ExitProcess
comctl32
InitCommonControlsEx
advapi32
LookupPrivilegeValueW
RegReplaceKeyW
RegOpenKeyExA
CryptSetProviderExA
CryptSetHashParam
CryptGenRandom
CryptDestroyKey
CreateServiceW
CryptSignHashW
CryptReleaseContext
LookupPrivilegeDisplayNameA
RegSaveKeyA
RegCreateKeyExW
LookupPrivilegeNameA
RegSetValueExW
CryptGetUserKey
user32
OpenDesktopW
GetWindow
DdeConnect
CreateWindowExA
RegisterHotKey
UnhookWinEvent
GetSubMenu
GetSysColorBrush
OemToCharW
GetClassInfoExA
UnpackDDElParam
IsRectEmpty
RegisterClassExA
GetKeyNameTextW
DrawTextA
GetPriorityClipboardFormat
OemKeyScan
GetScrollPos
SendMessageA
EnumDesktopsW
RegisterClassA
CharLowerW
Sections
.text Size: 227KB - Virtual size: 227KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 316KB - Virtual size: 315KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ