Static task
static1
Behavioral task
behavioral1
Sample
cfd199de824e4df24ad9c8974a0be798_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
cfd199de824e4df24ad9c8974a0be798_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
cfd199de824e4df24ad9c8974a0be798_JaffaCakes118
-
Size
446KB
-
MD5
cfd199de824e4df24ad9c8974a0be798
-
SHA1
6f4debf664772f430221e625033b2e2ab9ae7dee
-
SHA256
c5b75563e9a62575ed44836613f54cd90533db48ad93b834f27ecfc7e1e8c09e
-
SHA512
8242f289364065b55cfeaaeeb2a22f24ed43307826f061a788abc37b956a183532e4b1e6e4db33c3b168a24f5591ef7551c3d54c685c66860060fbb00394b17b
-
SSDEEP
6144:TZEiNBrLnDfC3/k4VX74Mq4RPPqNMdsUED+hJ+Pt6CH9HirSli3wQ74TFHAd:T5zaMWk9yPqNqEKLa56S2w5G
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cfd199de824e4df24ad9c8974a0be798_JaffaCakes118
Files
-
cfd199de824e4df24ad9c8974a0be798_JaffaCakes118.exe windows:4 windows x86 arch:x86
141b924f222b5cc84d1a8abd4a48f864
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CompareStringA
FillConsoleOutputCharacterW
HeapCreate
WriteConsoleOutputA
RtlUnwind
GetLocaleInfoW
GlobalUnfix
GetCurrentProcess
GetCurrentThread
VirtualAlloc
InitializeCriticalSectionAndSpinCount
GetTimeZoneInformation
HeapReAlloc
FreeLibrary
GlobalAlloc
FreeEnvironmentStringsW
LocalHandle
WideCharToMultiByte
GetModuleFileNameA
WritePrivateProfileSectionA
GetLocaleInfoA
VirtualFree
DeleteCriticalSection
GetFileType
TlsSetValue
LoadLibraryA
GetTickCount
GetSystemTimeAsFileTime
GetDateFormatA
GlobalFindAtomW
GetStdHandle
QueryPerformanceCounter
SetEnvironmentVariableA
IsValidCodePage
WriteFile
IsDebuggerPresent
LeaveCriticalSection
GetConsoleScreenBufferInfo
HeapAlloc
GetCPInfo
HeapFree
ConnectNamedPipe
TlsFree
GetCurrentProcessId
WritePrivateProfileStringW
GetModuleFileNameW
TlsGetValue
LCMapStringA
GetStartupInfoW
GetThreadPriority
EnterCriticalSection
GetModuleHandleW
SetCurrentDirectoryA
SetUnhandledExceptionFilter
IsValidLocale
GetLastError
DebugActiveProcess
TlsAlloc
Sleep
SetLastError
GlobalGetAtomNameW
SetConsoleCtrlHandler
InterlockedIncrement
UnhandledExceptionFilter
WaitForSingleObjectEx
GetCalendarInfoA
GetStartupInfoA
GetProcAddress
EnumSystemLocalesA
GetACP
GetThreadPriorityBoost
GetUserDefaultLCID
InterlockedExchange
GetStringTypeA
SetHandleCount
GetCommandLineW
VirtualQuery
MultiByteToWideChar
LCMapStringW
GetEnvironmentStringsA
HeapDestroy
GetCurrentThreadId
GetStringTypeW
GlobalSize
TerminateProcess
CompareStringW
GetTimeFormatA
GetProfileSectionW
GetModuleHandleA
InterlockedDecrement
GetEnvironmentStringsW
GetOEMCP
VirtualAllocEx
ExitProcess
HeapSize
CreateProcessA
shell32
SHFormatDrive
ShellExecuteExA
SheSetCurDrive
SHGetSpecialFolderPathA
SHBrowseForFolderW
SHGetSettings
SHFileOperation
SHGetNewLinkInfo
SHGetPathFromIDListA
ShellAboutW
SHFileOperationW
SHInvokePrinterCommandW
SHChangeNotify
wininet
ResumeSuspendedDownload
Sections
.text Size: 125KB - Virtual size: 125KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 311KB - Virtual size: 330KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ