Static task
static1
Behavioral task
behavioral1
Sample
ccfde149220e87e97198c23fb8115d5a_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
ccfde149220e87e97198c23fb8115d5a_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
ccfde149220e87e97198c23fb8115d5a_JaffaCakes118
-
Size
292KB
-
MD5
ccfde149220e87e97198c23fb8115d5a
-
SHA1
d514d08571ecd8cece8d704adc8d0c4fa87665ca
-
SHA256
34dffdb04ca07b014cdaee857690f86e490050335291ccc84c94994fa91e0160
-
SHA512
392a14c9a0c3a98c46e15b873919bdae13f5306a937fd8c869b2a2b435d236433a1eb78d6a953a1722d5b43cb69b4028459d6ea2387a904b4c0f2ec5bc36992e
-
SSDEEP
6144:qGZamLIoveyefyOrA80qE1lHJv3loPHVb6L:qEsomyef5k8k3Sby
Malware Config
Signatures
Files
-
ccfde149220e87e97198c23fb8115d5a_JaffaCakes118.exe windows:5 windows x86 arch:x86
672b84df309666b9d7d2bc8cc058e4c2
Code Sign
0c:ba:d7:e8:f5:97:8d:c1:bd:26:04:d3:7e:fd:f7:56Certificate
IssuerCN=GeoTrust RSA CA 2018,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before10-09-2018 00:00Not After17-09-2020 12:00SubjectCN=*.cyren.com,O=CYREN GmbH,L=Berlin,C=DEf9:21:f6:a5:0a:a3:7b:9b:af:66:ad:a0:c8:08:3a:93:c4:3c:f4:bdSigner
Actual PE Digestf9:21:f6:a5:0a:a3:7b:9b:af:66:ad:a0:c8:08:3a:93:c4:3c:f4:bdDigest Algorithmsha1PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcAddress
GetModuleHandleA
OpenFileMappingW
GetModuleFileNameA
BuildCommDCBAndTimeoutsA
DeleteTimerQueueTimer
LoadLibraryA
GetCPInfo
FindFirstChangeNotificationW
GetStringTypeExA
FindNextVolumeMountPointA
GetConsoleAliasesLengthA
VerLanguageNameW
lstrlenA
FlushFileBuffers
CloseHandle
HeapUnlock
HeapCompact
GetPrivateProfileStringW
GetFirmwareEnvironmentVariableA
WriteConsoleOutputW
CreateFileA
WriteConsoleW
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
MultiByteToWideChar
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
RtlUnwind
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
GetLastError
HeapFree
GetStartupInfoW
LCMapStringA
LCMapStringW
HeapAlloc
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetACP
GetOEMCP
IsValidCodePage
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
HeapSize
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
InitializeCriticalSectionAndSpinCount
SetFilePointer
GetConsoleCP
GetConsoleMode
GetLocaleInfoW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
user32
SetWindowTextA
GetMenuInfo
SendMessageA
advapi32
RegDeleteValueW
BackupEventLogA
RegRestoreKeyW
OpenServiceW
msimg32
AlphaBlend
Sections
.text Size: 109KB - Virtual size: 108KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 22KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 125KB - Virtual size: 712KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ