Static task
static1
Behavioral task
behavioral1
Sample
d4b9bb0dce55a96ad572e1cd6092f5d3_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d4b9bb0dce55a96ad572e1cd6092f5d3_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
d4b9bb0dce55a96ad572e1cd6092f5d3_JaffaCakes118
-
Size
3.5MB
-
MD5
d4b9bb0dce55a96ad572e1cd6092f5d3
-
SHA1
38fe3a505d71971c28aa583be1ec06304ab10296
-
SHA256
8d38f7a07152c7bf2e98b3037f3b82ec1bb07567e1ad414465550971622cdb6c
-
SHA512
45e4d92d950232acb5515fa32e9ce01c7c9d781527de21de844474ea5feaa14bef20245c4889e864b074768b2e41eff689be8b3c00b67d1790f4922556a3e40e
-
SSDEEP
98304:oZKUioZDZYRBPwTZ8ImjFoBZIABS9X/xr+BxzEUgG:oZKUHlOBPm8Im5OGAk9X/xqUUgG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d4b9bb0dce55a96ad572e1cd6092f5d3_JaffaCakes118
Files
-
d4b9bb0dce55a96ad572e1cd6092f5d3_JaffaCakes118.exe windows:5 windows x86 arch:x86
edabacd5fe0c1d8e156d4e6065bc5be9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
Imports
shlwapi
PathAppendW
kernel32
WriteConsoleW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetLastError
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
LoadLibraryW
LoadLibraryExW
GetModuleFileNameA
GetModuleFileNameW
LocalFree
FormatMessageA
FormatMessageW
GetCurrentProcessId
GetCurrentThreadId
SetLastError
SetFileTime
CloseHandle
GetTickCount
GetSystemDirectoryW
GetTempPathA
GetTempPathW
GetWindowsDirectoryW
SetCurrentDirectoryA
SetCurrentDirectoryW
GetCurrentDirectoryA
GetCurrentDirectoryW
CreateDirectoryA
RemoveDirectoryA
RemoveDirectoryW
GetFullPathNameA
GetFullPathNameW
CreateFileW
SetFileAttributesA
SetFileAttributesW
DeleteFileA
DeleteFileW
FindClose
FindFirstFileA
FindFirstFileW
FindNextFileA
FindNextFileW
GetFileSize
WriteFile
ReadFile
SetEndOfFile
SetFilePointer
CreateFileA
GetStdHandle
EnterCriticalSection
LeaveCriticalSection
WaitForMultipleObjects
Sleep
VirtualAlloc
VirtualFree
GetVersionExA
InitializeCriticalSection
SetEvent
ResetEvent
WaitForSingleObject
CreateEventA
GetProcAddress
GetExitCodeProcess
CreateProcessA
GetCommandLineW
SetFilePointerEx
SetStdHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetStringTypeW
LCMapStringW
SetUnhandledExceptionFilter
OutputDebugStringW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetFileType
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
HeapSize
GetModuleHandleExW
ExitProcess
GetProcessHeap
GetModuleHandleW
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
UnhandledExceptionFilter
InterlockedDecrement
InterlockedIncrement
GetCommandLineA
ExitThread
CreateThread
HeapReAlloc
EncodePointer
DecodePointer
RaiseException
RtlUnwind
IsDebuggerPresent
IsProcessorFeaturePresent
HeapFree
HeapAlloc
GetCurrentProcess
user32
DestroyWindow
LoadIconA
KillTimer
SetTimer
GetDlgItem
EndDialog
PostMessageA
SendMessageA
MessageBoxW
SetWindowTextW
SetWindowTextA
LoadStringW
LoadStringA
SetWindowLongA
GetWindowLongA
DialogBoxParamW
DialogBoxParamA
ShowWindow
CharLowerW
CharLowerA
CharUpperW
CharUpperA
shell32
ord165
ShellExecuteExA
oleaut32
VariantClear
SysAllocString
Sections
.text Size: 117KB - Virtual size: 116KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 42KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 88KB - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ