Static task
static1
Behavioral task
behavioral1
Sample
d2f78fc7c2f7826553aac36351b31fe2_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d2f78fc7c2f7826553aac36351b31fe2_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
d2f78fc7c2f7826553aac36351b31fe2_JaffaCakes118
-
Size
168KB
-
MD5
d2f78fc7c2f7826553aac36351b31fe2
-
SHA1
03a7d44eda49579f4291876a141a580d83a984ad
-
SHA256
4caf5c60ddd66fcace2aab8cece8822df30e2637a5fc2595439bdcac3c147be7
-
SHA512
f7bd8f65e8730435cc0c718d1f3d154a7456eff6470d5e304eddfc755afc279c33370bc31d6f4083a7af38b2c6d43e23e0073c821c0736f444b419a4a30d38e4
-
SSDEEP
1536:EEgJ9s6Qar1xa3nDuc+yS81Efnwsz+5tVLjNPeReoc0xlRytk5sE8vgo:Hx6Qar1mnkNfGVNPPYlRy+5sEego
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d2f78fc7c2f7826553aac36351b31fe2_JaffaCakes118
Files
-
d2f78fc7c2f7826553aac36351b31fe2_JaffaCakes118.exe windows:4 windows x86 arch:x86
1bc8a8ab15f37dfcacba988951c15280
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCurrentProcess
GetProcAddress
GetModuleHandleA
GetSystemDirectoryW
GetSystemDirectoryA
GetACP
GetLocaleInfoA
GetVersionExA
SetLastError
CopyFileW
GetModuleFileNameA
GetModuleFileNameW
GetTempFileNameW
LoadLibraryA
CreateProcessA
SetEndOfFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetFilePointer
InitializeCriticalSection
FlushFileBuffers
GetConsoleMode
GetConsoleCP
SetStdHandle
GetTempPathW
GetWindowsDirectoryW
SetFileAttributesW
DeleteFileW
GetWindowsDirectoryA
MultiByteToWideChar
WideCharToMultiByte
ReadFile
CreateFileW
CreateFileA
GetLastError
GetFileSize
CloseHandle
OutputDebugStringA
OutputDebugStringW
lstrcpyA
GetLocalTime
HeapSize
Sleep
GetStringTypeW
GetStringTypeA
HeapReAlloc
VirtualAlloc
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
VirtualFree
HeapCreate
HeapDestroy
RtlUnwind
GetCommandLineA
HeapFree
HeapAlloc
GetProcessHeap
GetStartupInfoA
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThreadId
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
EnterCriticalSection
LeaveCriticalSection
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
LCMapStringA
LCMapStringW
ExitProcess
WriteFile
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
user32
wsprintfA
wvsprintfA
MessageBoxA
wsprintfW
lz32
LZClose
LZOpenFileW
LZCopy
version
GetFileVersionInfoW
VerQueryValueA
GetFileVersionInfoSizeW
Sections
.text Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 16KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 8KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 72KB - Virtual size: 152KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE