Static task
static1
Behavioral task
behavioral1
Sample
d38a4a2373eb9899db093cbcf9fb44d6_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
d38a4a2373eb9899db093cbcf9fb44d6_JaffaCakes118
-
Size
420KB
-
MD5
d38a4a2373eb9899db093cbcf9fb44d6
-
SHA1
325b19cc4cd9eda7b90d66dddd62dc8722a31da9
-
SHA256
90615f539ffefe47f834dcdde20948e38b6e5953c465863f78a537ff29b2a2ee
-
SHA512
b5595a8670c419ab6c900e8a003a96b83c3c52b6ae85da0ebb58359a5f3b05390ba1c18805e45c7487cc2d6397d761df9ebf0a5e7106a255c7430402b96e2ba9
-
SSDEEP
6144:U/sa4+hYvC9QiduM1O5I7B20oSTwmTYbzHrVFSr6Sd:da1hYvC9QsuM1O5I7oSNTYjvSrb
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d38a4a2373eb9899db093cbcf9fb44d6_JaffaCakes118
Files
-
d38a4a2373eb9899db093cbcf9fb44d6_JaffaCakes118.exe windows:4 windows x86 arch:x86
75e80bb0ee7b9af33e275abf7f2c5cd6
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
imm32
ImmDisableIME
kernel32
MapViewOfFile
UnmapViewOfFile
WideCharToMultiByte
CreateMutexW
GetCurrentThreadId
ReleaseMutex
OpenMutexW
WaitForSingleObject
FindClose
LocalFree
FindFirstFileW
InterlockedIncrement
InterlockedCompareExchange
GetFileSize
SetFilePointer
WriteFile
ReadFile
FlushFileBuffers
SetLastError
LCMapStringW
GetTickCount
QueryPerformanceFrequency
CreateThread
Sleep
InterlockedExchange
InterlockedDecrement
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
GetSystemTimeAsFileTime
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoW
RtlUnwind
RaiseException
GetTimeZoneInformation
GetCPInfo
LCMapStringA
GetStringTypeA
GetStringTypeW
SetHandleCount
GetStdHandle
CreateFileW
GetStartupInfoA
GetFullPathNameW
GetCurrentDirectoryA
GetConsoleCP
GetConsoleMode
GetModuleHandleA
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
GetACP
GetOEMCP
IsValidCodePage
ExitProcess
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
QueryPerformanceCounter
GetCurrentProcessId
HeapSize
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
LoadLibraryA
CreateFileA
GetLocaleInfoW
SetEndOfFile
GetDriveTypeA
CompareStringA
CompareStringW
SetEnvironmentVariableA
CloseHandle
OpenFileMappingW
CreateFileMappingW
GetVersionExW
GetCommandLineW
GetModuleFileNameW
CopyFileW
MultiByteToWideChar
GetLastError
DeleteFileW
CreateDirectoryW
GetFileType
user32
MessageBoxW
advapi32
RegQueryValueExW
RegCloseKey
RegCreateKeyExW
BuildExplicitAccessWithNameW
GetSecurityDescriptorSacl
SetEntriesInAclW
SetSecurityInfo
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetNamedSecurityInfoW
GetSecurityInfo
SetNamedSecurityInfoW
RegOpenKeyExW
RegQueryValueW
shell32
SHGetSpecialFolderPathW
Sections
.text Size: 220KB - Virtual size: 216KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 52KB - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128KB - Virtual size: 137KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.text Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE