Static task
static1
Behavioral task
behavioral1
Sample
b9a668607e9dbedc1a2267f0677d858f_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
b9a668607e9dbedc1a2267f0677d858f_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
b9a668607e9dbedc1a2267f0677d858f_JaffaCakes118
-
Size
789KB
-
MD5
b9a668607e9dbedc1a2267f0677d858f
-
SHA1
60a737eecd8d1715b7b7f40aa9881eed931f7f0a
-
SHA256
e840a8489d45bde54d081b970fa4cf60c3923c77bb09f74d514601b78feb65aa
-
SHA512
1159ac64c1fd962c49e0d3ca60c3449091efab27bdcfe770301daec36e7d4a978ddc75fb0805e56a1d99b3cc38f30b794d50a782746aa47be28e756392bc1db5
-
SSDEEP
12288:O4u142k5E8o7MuEb5qRwumY7+onFTJWJEpeoR5WDTrKDhcATnQYUaJ81RKbM3FRh:Ik+8o78EKKnRJWClR2ScLYUX3tF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b9a668607e9dbedc1a2267f0677d858f_JaffaCakes118
Files
-
b9a668607e9dbedc1a2267f0677d858f_JaffaCakes118.exe windows:4 windows x86 arch:x86
067b6ef89b8d9a5113aebe70479d6788
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
gdi32
ColorCorrectPalette
StretchDIBits
CreatePalette
RectVisible
GetCharABCWidthsFloatA
OffsetClipRgn
SetICMProfileW
ChoosePixelFormat
SetWorldTransform
GdiGetBatchLimit
GetSystemPaletteUse
CreateHalftonePalette
GetMiterLimit
SetWindowOrgEx
comctl32
InitCommonControlsEx
user32
TrackMouseEvent
RegisterClassA
GetAltTabInfo
ShowCursor
IsIconic
DefWindowProcW
GetAncestor
RegisterClassExA
GetKeyboardType
DestroyCaret
DestroyAcceleratorTable
TileWindows
kernel32
GetTimeZoneInformation
SetEnvironmentVariableA
GetOEMCP
TryEnterCriticalSection
WriteFile
InterlockedIncrement
GetCurrentProcess
GetStringTypeA
GetConsoleOutputCP
GetConsoleMode
InterlockedExchange
GetCommandLineA
LoadLibraryA
LocalLock
GetCurrentThread
GetTimeFormatA
EnterCriticalSection
LoadLibraryW
FoldStringA
HeapValidate
ExitProcess
GetModuleFileNameA
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetEnvironmentStringsW
GetModuleHandleA
TlsSetValue
LeaveCriticalSection
SetStdHandle
WriteConsoleA
SetConsoleCtrlHandler
GetStringTypeW
FlushFileBuffers
GetStdHandle
TlsFree
VirtualQuery
VirtualAlloc
TlsGetValue
GetACP
GetLocaleInfoA
HeapReAlloc
SetHandleCount
GetTickCount
lstrlenA
GetFileType
QueryPerformanceCounter
HeapSize
EnumSystemLocalesA
HeapFree
GetConsoleCP
UnhandledExceptionFilter
GetCurrentDirectoryW
lstrcmpiW
GetProcAddress
RtlUnwind
Sleep
GetStartupInfoA
GetCurrentProcessId
GetStartupInfoW
GetProcessHeap
GetSystemTimeAsFileTime
OutputDebugStringW
GetModuleFileNameW
InterlockedDecrement
TerminateProcess
CloseHandle
HeapDestroy
SetLastError
WideCharToMultiByte
GetWindowsDirectoryA
VirtualFree
GetCPInfo
SetFilePointer
WriteConsoleW
FindResourceExA
GetCommandLineW
LCMapStringA
HeapAlloc
OutputDebugStringA
DebugBreak
FillConsoleOutputAttribute
CompareStringW
GetLocaleInfoW
IsValidCodePage
GetLastError
FreeEnvironmentStringsW
CreateFileA
TlsAlloc
MultiByteToWideChar
EnumDateFormatsExW
OpenMutexA
ReadFile
GetTempFileNameW
EnumCalendarInfoExA
IsDebuggerPresent
SetUnhandledExceptionFilter
GetModuleHandleW
FreeLibrary
GetCurrentThreadId
HeapCreate
GetDateFormatA
LCMapStringW
IsBadReadPtr
CreateMutexA
LoadLibraryExA
IsValidLocale
GetUserDefaultLCID
RaiseException
CompareStringA
advapi32
ReportEventA
RegRestoreKeyW
CryptSetProviderExW
CryptSetHashParam
RegEnumValueA
RegSetValueExA
RegReplaceKeyA
LookupPrivilegeNameW
CreateServiceW
CryptGetProvParam
CryptImportKey
CryptSignHashW
CryptVerifySignatureA
AbortSystemShutdownA
RegCreateKeyA
CryptExportKey
CryptGetDefaultProviderA
InitiateSystemShutdownA
shell32
ShellExecuteExW
DoEnvironmentSubstA
SHFormatDrive
SHInvokePrinterCommandW
SHGetSpecialFolderLocation
comdlg32
PageSetupDlgA
PageSetupDlgW
Sections
.text Size: 409KB - Virtual size: 409KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 49KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 322KB - Virtual size: 321KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ