Static task
static1
Behavioral task
behavioral1
Sample
d2fd0b7315c279fa617c44e7f5a758a0_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d2fd0b7315c279fa617c44e7f5a758a0_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
d2fd0b7315c279fa617c44e7f5a758a0_JaffaCakes118
-
Size
266KB
-
MD5
d2fd0b7315c279fa617c44e7f5a758a0
-
SHA1
ae44ac2f125f44e0568eaa3762f7b7464cb11710
-
SHA256
ff2c1f348f26a2fbcf11ff6fd84fbed39d931c191cc9dc39f6b5c47720a07f8f
-
SHA512
091824ae8832b3700c07491e42c9c84c96c288750cba15d1c39ecdbc871f2b00914df5b5e6f74b003e5932b85b295e94bc35b34a3ec61284cfacf56ac9ec8af1
-
SSDEEP
6144:HLZvT5kuch1RbwHwpmRTamIhUgVZbap1fqFrge4fr51zpTM:Nfch1RPpmRTam4jbaAglnzq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d2fd0b7315c279fa617c44e7f5a758a0_JaffaCakes118
Files
-
d2fd0b7315c279fa617c44e7f5a758a0_JaffaCakes118.exe windows:4 windows x86 arch:x86
51c4a9957d1629b91cc2a8ebf21554c0
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleFileNameW
GetLastError
GetTickCount
GetCurrentProcess
MultiByteToWideChar
GetSystemDirectoryW
GetVersionExA
GetProcessHeap
GetStartupInfoW
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleA
TlsAlloc
GetCurrentThreadId
HeapCreate
ExitProcess
GetModuleFileNameA
GetEnvironmentStringsW
GetStartupInfoA
QueryPerformanceCounter
GetCurrentProcessId
GetStringTypeA
GetStringTypeW
Sleep
GetLocaleInfoA
InitializeCriticalSection
LoadLibraryA
GetModuleHandleW
GetProcAddress
user32
GetSystemMetrics
advapi32
RegSetValueExW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegDeleteKeyW
CloseServiceHandle
StartServiceW
OpenServiceW
OpenSCManagerW
loadperf
SetServiceAsTrustedW
LoadPerfCounterTextStringsA
RestorePerfRegistryFromFileW
dciman32
DCISetClipList
GetDCRegionData
Sections
CODE Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.be Size: 2KB - Virtual size: 273KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 1KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.Uo Size: 4KB - Virtual size: 762KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.edata Size: 93KB - Virtual size: 109KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.zLS Size: 3KB - Virtual size: 502KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 370KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.lRnRO Size: 2KB - Virtual size: 134KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.edata Size: 123KB - Virtual size: 190KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.B Size: 4KB - Virtual size: 980KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.afW Size: 512B - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ