Static task
static1
Behavioral task
behavioral1
Sample
d2b916976c325f35c0c8b825bc43d956_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d2b916976c325f35c0c8b825bc43d956_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
d2b916976c325f35c0c8b825bc43d956_JaffaCakes118
-
Size
2.2MB
-
MD5
d2b916976c325f35c0c8b825bc43d956
-
SHA1
8b5d833ea9111c4fb49b5add8437f00985483aaa
-
SHA256
d452363e80e6d603afd267e953a22b90f325cb39b784f6d1911d450049f93f6a
-
SHA512
6b438260416ac52ded1a389e63417db9270cd1fc423c55db1dbd71497f9ea13bad64c8338136ca2ffafabc10634dda1dc0612ce64495521cf09538f41c27134a
-
SSDEEP
24576:QpzBMrIq8OiEew7cjWrV1KTATD3HoqXhQkpZd0:QLE3fV1KHqXukpZu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d2b916976c325f35c0c8b825bc43d956_JaffaCakes118
Files
-
d2b916976c325f35c0c8b825bc43d956_JaffaCakes118.exe windows:5 windows x86 arch:x86
0665bb328f501078eae6cc1132ba7bde
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
winspool.drv
FindNextPrinterChangeNotification
kernel32
GetCurrentThreadId
DecodePointer
ExitProcess
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
WideCharToMultiByte
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameW
WriteFile
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
SetLastError
TlsFree
IsDebuggerPresent
IsValidCodePage
GetACP
GetCPInfo
EnterCriticalSection
LeaveCriticalSection
HeapFree
GetLastError
RtlUnwind
OutputDebugStringW
GetStringTypeW
HeapAlloc
HeapReAlloc
LCMapStringW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetStdHandle
SetFilePointerEx
WriteConsoleW
CloseHandle
EncodePointer
IsProcessorFeaturePresent
RaiseException
GetCommandLineW
GetConsoleWindow
GetLocaleInfoW
GetOEMCP
CancelIo
CreateFileW
GetModuleHandleW
LoadLibraryExW
GetLocalTime
GetSystemTime
SetFileTime
SetHandleCount
HeapSize
VirtualAlloc
TlsSetValue
advapi32
RegCreateKeyExW
OpenSCManagerW
RegQueryValueExW
crypt32
CertGetEnhancedKeyUsage
CertAddStoreToCollection
CertFreeCTLContext
CertAddEncodedCertificateToStore
CertGetCertificateContextProperty
CertGetPublicKeyLength
CertCreateCertificateContext
CertCloseStore
CryptMsgUpdate
CryptDecodeObjectEx
CryptEncodeObjectEx
CertFindExtension
CryptStringToBinaryW
CertSetCertificateContextProperty
CertVerifyCertificateChainPolicy
CertNameToStrW
user32
GetScrollBarInfo
DrawEdge
DispatchMessageW
PeekMessageW
BroadcastSystemMessageW
CreateDialogParamW
IsDlgButtonChecked
ReleaseCapture
GetMenu
EnableMenuItem
GetSubMenu
GetMenuItemID
GetMenuItemCount
InsertMenuW
DrawTextW
GetWindowRgn
ScrollWindow
SetPropW
SetCursor
GetCursor
CreateCaret
UnionRect
Sections
.text Size: 111KB - Virtual size: 110KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 757KB - Virtual size: 7.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: 1024B - Virtual size: 724B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.6tfeew Size: 365KB - Virtual size: 364KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.lrfu Size: 187KB - Virtual size: 186KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.1lcrr Size: 247KB - Virtual size: 246KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.wt8s19 Size: 474KB - Virtual size: 474KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 109KB - Virtual size: 109KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ