Static task
static1
Behavioral task
behavioral1
Sample
d167ae0a866b2c6b34a3537809370ecc_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d167ae0a866b2c6b34a3537809370ecc_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
d167ae0a866b2c6b34a3537809370ecc_JaffaCakes118
-
Size
212KB
-
MD5
d167ae0a866b2c6b34a3537809370ecc
-
SHA1
11fbc5410f231fc8408841d2ab493bdea57d2137
-
SHA256
c27c9fea576bcd1f468e1a388bb93270d3054102818ac437cd8971ae1c4994fc
-
SHA512
eaf5e448d2f0f9e1527c1e4be8591d8e409a7be8db81059c094dacffa9677d350f02a6f6de6c35f04f25368b5f82f053c0b1e7f509be99a78f999a77b5776824
-
SSDEEP
1536:69/PSoI+m8OyMrJ8j5JOxjFUCOf+Dwhnjigu4LQtBM2Abd9W:69/PSoI+7PMFs5JmXAljNuxM2f
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d167ae0a866b2c6b34a3537809370ecc_JaffaCakes118
Files
-
d167ae0a866b2c6b34a3537809370ecc_JaffaCakes118.exe windows:4 windows x86 arch:x86
6736a9afce3a0c267b6e3012bb6ab240
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
HeapDestroy
DeleteCriticalSection
Sleep
lstrcmpiA
GetCurrentThreadId
GetCommandLineA
InitializeCriticalSection
InterlockedIncrement
lstrlenW
MultiByteToWideChar
lstrlenA
GetShortPathNameA
GetModuleHandleA
CreateEventA
FreeLibrary
GetProcAddress
LoadLibraryA
lstrcpyA
lstrcatA
WideCharToMultiByte
GetStringTypeA
SetUnhandledExceptionFilter
WriteFile
GetFileType
GetStdHandle
FlushFileBuffers
CreateThread
CloseHandle
SetEvent
InterlockedDecrement
CreateMutexA
WaitForSingleObject
GetModuleFileNameA
ReleaseMutex
ReadFile
SetStdHandle
IsBadCodePtr
IsBadReadPtr
SetFilePointer
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
HeapSize
GetLastError
LocalFree
RtlUnwind
HeapFree
HeapAlloc
GetStartupInfoA
GetVersion
ExitProcess
RaiseException
GetCPInfo
GetACP
GetOEMCP
LCMapStringA
LCMapStringW
GetEnvironmentVariableA
GetVersionExA
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
IsBadWritePtr
TerminateProcess
GetCurrentProcess
GetStringTypeW
user32
wsprintfA
PostThreadMessageA
CharNextA
DispatchMessageA
GetMessageA
advapi32
RegSetValueExA
RegOpenKeyExA
RegCloseKey
RegEnumKeyExA
RegOpenKeyA
RegQueryValueExA
RegCreateKeyExA
ole32
CoUninitialize
CoRevokeClassObject
CoRegisterClassObject
CoInitialize
CoCreateInstance
oleaut32
RegisterTypeLi
LoadTypeLi
SysAllocString
SysStringByteLen
SysAllocStringByteLen
SysFreeString
VariantClear
Sections
bkav.plp Size: 96KB - Virtual size: 95KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 56KB - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ