Static task
static1
Behavioral task
behavioral1
Sample
d2d5bc1f6a39af46957203336ef05469_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d2d5bc1f6a39af46957203336ef05469_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
d2d5bc1f6a39af46957203336ef05469_JaffaCakes118
-
Size
56KB
-
MD5
d2d5bc1f6a39af46957203336ef05469
-
SHA1
9cbfbacdd4954c2973c7cc077ff64fd3dcc0c1b4
-
SHA256
ed93163d637b4bf5955097dd0ed777b00eed6dcec21e0abdcc355a071722ada8
-
SHA512
563031dd1ac17bb83893a01b92a14014d11dd3911a938f24e44dc733c1b493fe2f3276c3efa8e15de570e2cc1f58b5729073e77b37cbe896bf7f092102edd217
-
SSDEEP
1536:3rKBhaMUBu6JOxBHCKh0ak0MzkGHfw4oegh/rb8R7:3rKBhTUBbJ+HthLMzkWf2h/38R7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d2d5bc1f6a39af46957203336ef05469_JaffaCakes118
Files
-
d2d5bc1f6a39af46957203336ef05469_JaffaCakes118.exe windows:4 windows x86 arch:x86
301d2e4e8b389b88da15b7c134bf0e95
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
AdjustTokenPrivileges
AllocateAndInitializeSid
EqualSid
GetTokenInformation
LockServiceDatabase
RegDeleteKeyA
RegEnumKeyExA
kernel32
CloseHandle
CreateEventA
CreateFileA
CreateFileMappingA
DeleteCriticalSection
DeviceIoControl
DisableThreadLibraryCalls
DuplicateHandle
EnterCriticalSection
EnumSystemLocalesA
ExitProcess
ExitThread
FileTimeToLocalFileTime
FindResourceA
FormatMessageA
FreeEnvironmentStringsA
FreeLibrary
GetConsoleOutputCP
GetCurrentProcess
GetCurrentThreadId
GetEnvironmentVariableA
GetExitCodeProcess
GetFileType
GetLastError
GetLocalTime
GetLocaleInfoA
GetModuleFileNameA
GetModuleHandleA
GetOEMCP
GetPrivateProfileStringA
GetPrivateProfileStructA
GetProcAddress
GetProcessHeap
GetShortPathNameA
GetStartupInfoA
GetStdHandle
GetStringTypeA
GetSystemInfo
GetTempFileNameA
GetTempPathA
GetTickCount
GetTimeFormatA
GetUserDefaultLCID
GetVersionExA
GlobalFree
GlobalReAlloc
HeapAlloc
HeapFree
HeapSize
InitializeCriticalSection
InterlockedCompareExchange
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
IsBadCodePtr
IsBadReadPtr
IsBadWritePtr
IsDebuggerPresent
IsValidCodePage
LCMapStringA
LeaveCriticalSection
LocalAlloc
LocalFree
Module32First
Module32Next
MulDiv
OpenProcess
QueryPerformanceCounter
ReadFile
ReleaseMutex
ResumeThread
RtlUnwind
SetFileTime
SetLastError
TerminateProcess
TlsAlloc
VirtualProtect
lstrcpyA
lstrcpynA
lstrlenA
user32
CallNextHookEx
CreateWindowExA
DefWindowProcA
DialogBoxParamA
EqualRect
GetDC
GetDesktopWindow
GetDlgItem
GetMessageA
GetMessagePos
GetParent
GetSysColor
GetSystemMenu
IntersectRect
IsDlgButtonChecked
MapWindowPoints
MessageBoxA
PostQuitMessage
RegisterClassA
ReleaseCapture
SendDlgItemMessageA
SetDlgItemInt
SetDlgItemTextA
SetWindowLongA
SetWindowPos
UnhookWindowsHookEx
wsprintfA
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
Sections
.text Size: 21KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.CRT Size: 13KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.edata Size: 15KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ