Static task
static1
Behavioral task
behavioral1
Sample
c93ea70e62925f7cb972e10c8ea47d44_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
c93ea70e62925f7cb972e10c8ea47d44_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
c93ea70e62925f7cb972e10c8ea47d44_JaffaCakes118
-
Size
1.1MB
-
MD5
c93ea70e62925f7cb972e10c8ea47d44
-
SHA1
27eb1688612afaf5ba4016f06ddc2fffcdcbf01f
-
SHA256
210ef7256129c161610f85c4f665edc93ef343ea275fd528bd1b925c8caa9898
-
SHA512
eb6a50a8fc7060486b3880d4488797ddb63eef6ec8d48888e879ed9f206fc0f7939c01df02e949a93352a570ea51f66c43fd269db80ea7773cf48663926cabd6
-
SSDEEP
24576:DNK5rHlc2QFOGN+lkI/q6N1UBZJ/4trp1uE:DNKlHqOGeBiNip1x
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c93ea70e62925f7cb972e10c8ea47d44_JaffaCakes118
Files
-
c93ea70e62925f7cb972e10c8ea47d44_JaffaCakes118.exe windows:5 windows x86 arch:x86
7cd93ba64f66a9f883376735386bd23c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
VirtualAlloc
VirtualAllocEx
GetLastError
ReadProcessMemory
WriteProcessMemory
GetThreadContext
SetThreadContext
ResumeThread
LoadResource
SizeofResource
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
CreateProcessA
FindResourceW
FindResourceExW
MultiByteToWideChar
WideCharToMultiByte
FreeConsole
RaiseException
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
HeapDestroy
GetProcAddress
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
CreateFileW
CloseHandle
WriteConsoleW
SetFilePointerEx
SetStdHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetStringTypeW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
LoadLibraryW
OutputDebugStringW
SetConsoleCtrlHandler
LockResource
InterlockedDecrement
HeapAlloc
InitializeCriticalSectionAndSpinCount
LoadLibraryExW
FreeLibrary
InterlockedExchange
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FatalAppExitA
IsDebuggerPresent
Sleep
IsProcessorFeaturePresent
CreateSemaphoreW
lstrlenA
LocalFree
lstrlenW
GetCommandLineW
EncodePointer
DecodePointer
RtlUnwind
SetLastError
InterlockedIncrement
GetCurrentThread
GetCurrentThreadId
ExitProcess
GetModuleHandleExW
AreFileApisANSI
GetStdHandle
WriteFile
GetFileType
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
user32
LoadStringW
LoadIconW
LoadCursorW
EndPaint
BeginPaint
UpdateWindow
LoadAcceleratorsW
EndDialog
DialogBoxParamW
ShowWindow
DestroyWindow
CreateWindowExW
RegisterClassExW
PostQuitMessage
DefWindowProcW
DispatchMessageW
TranslateMessage
GetMessageW
TranslateAcceleratorW
advapi32
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
ole32
CoInitializeSecurity
CoSetProxyBlanket
CoCreateInstance
CoInitializeEx
CoUninitialize
oleaut32
CreateErrorInfo
SysAllocString
SysAllocStringByteLen
SysStringByteLen
SysFreeString
SetErrorInfo
VariantChangeType
VariantInit
VariantClear
GetErrorInfo
shlwapi
PathFindFileNameW
Sections
.text Size: 137KB - Virtual size: 136KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 906KB - Virtual size: 905KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ