Static task
static1
Behavioral task
behavioral1
Sample
d38d8579f30647bf07127f7d0ed022a5_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d38d8579f30647bf07127f7d0ed022a5_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
d38d8579f30647bf07127f7d0ed022a5_JaffaCakes118
-
Size
580KB
-
MD5
d38d8579f30647bf07127f7d0ed022a5
-
SHA1
9cbd782e5a6367903862e1cc574112ec73d7c90a
-
SHA256
897d46511d8350ae69c96dccc49bfbb8fac8fa6e00b03c1dc416bc77eab90eaf
-
SHA512
0a9a5dce7ae00dd541bd372bf7b6b2ee111e30c7586945ad7ed92f2d5b9de457a9bcbc7862376bc9e1ef40bae2301a188340e00ab477c4d310223fe2605cc890
-
SSDEEP
6144:z25VCIlyTJQMj1xCd5BMj7imvr8idB6Di1g+ENx2pcNl7PDcj/E:xIlZYCjBMbvr892gxQpcvrc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d38d8579f30647bf07127f7d0ed022a5_JaffaCakes118
Files
-
d38d8579f30647bf07127f7d0ed022a5_JaffaCakes118.exe windows:4 windows x86 arch:x86
2794914636587f3d1a4ee178b2e747f2
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
InitiateSystemShutdownA
GetSidIdentifierAuthority
LockServiceDatabase
IsValidSecurityDescriptor
QueryServiceConfigA
RegConnectRegistryW
MakeAbsoluteSD
AllocateAndInitializeSid
kernel32
ExitProcess
_lread
IsDBCSLeadByteEx
DuplicateHandle
RaiseException
CopyFileExW
GetOEMCP
GetDiskFreeSpaceExA
SetProcessAffinityMask
SetErrorMode
RemoveDirectoryA
FindFirstFileA
GetCurrentDirectoryW
GetFileAttributesA
GlobalDeleteAtom
GlobalFlags
FindResourceExA
QueryDosDeviceW
GlobalFindAtomW
InitializeCriticalSection
ReadConsoleA
GetCommModemStatus
lstrcmpA
GlobalReAlloc
ReadDirectoryChangesW
GlobalFindAtomA
EnumCalendarInfoW
CreateEventA
LocalFileTimeToFileTime
GetLocaleInfoW
GetPrivateProfileStringA
SetMailslotInfo
QueryDosDeviceA
VirtualQuery
GenerateConsoleCtrlEvent
WritePrivateProfileSectionW
IsBadStringPtrA
AllocConsole
SetEnvironmentVariableA
GetSystemTimeAsFileTime
FreeLibraryAndExitThread
CloseHandle
_lclose
WaitNamedPipeA
GlobalFree
DeleteCriticalSection
GlobalUnlock
EnumResourceNamesW
SetTimeZoneInformation
VirtualUnlock
_llseek
SetConsoleTitleA
GetFileType
GetACP
MoveFileW
EnumCalendarInfoA
EnumResourceLanguagesW
WriteProcessMemory
DeleteFiber
oleaut32
SafeArrayRedim
SysStringLen
VariantCopy
SysFreeString
VariantChangeType
SafeArrayPutElement
SafeArrayCreate
SetErrorInfo
SysAllocStringLen
LoadTypeLibEx
user32
DrawFocusRect
RegisterWindowMessageW
GetDoubleClickTime
GetMenuItemInfoW
OemToCharA
SendMessageA
SetClassLongA
LoadStringA
LoadCursorFromFileW
DefDlgProcW
SetClassLongW
GetWindowTextA
CopyImage
BeginDeferWindowPos
NotifyWinEvent
GetWindowLongW
WindowFromPoint
GetMessageA
MessageBoxA
DefDlgProcA
SetWindowPlacement
EnableMenuItem
GetWindowDC
MessageBoxW
DragDetect
DrawStateW
SetMenu
CreateDialogParamA
ole32
OleInitialize
CoTaskMemRealloc
PropVariantCopy
CoGetInterfaceAndReleaseStream
StgOpenStorage
CreateStreamOnHGlobal
Sections
.text Size: 7KB - Virtual size: 223KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 263KB - Virtual size: 262KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ