Static task
static1
Behavioral task
behavioral1
Sample
d5a8ea80a434ea9dffc86d4399a8ea29_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d5a8ea80a434ea9dffc86d4399a8ea29_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
d5a8ea80a434ea9dffc86d4399a8ea29_JaffaCakes118
-
Size
81KB
-
MD5
d5a8ea80a434ea9dffc86d4399a8ea29
-
SHA1
46c3820eeb95d01e6fdc18117a3ac2580d7d361d
-
SHA256
161e7d1a22666acefec16d52f68b955b05cf98e0c1ffe1241d9a333c3ff8ea95
-
SHA512
02bdef3d907b0efe779841dca8b8ca9b122072cb30ce3b76c6ca1c53538570c6bebe9008f1a74db29dcd77118dbc66c7c6567960b5107f7deeb1d043939f8e20
-
SSDEEP
1536:q5FqzGO4R2MwQ2MxBDCBKehQFfCXNg2bo5WWvDD:qOqTsBntW2bo5WWvX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d5a8ea80a434ea9dffc86d4399a8ea29_JaffaCakes118
Files
-
d5a8ea80a434ea9dffc86d4399a8ea29_JaffaCakes118.exe windows:4 windows x86 arch:x86
256ad35a8b89d4dcf638e06cbf164dd3
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
TerminateProcess
FreeLibrary
GetProcAddress
LoadLibraryA
IsBadWritePtr
GetSystemDirectoryA
MultiByteToWideChar
lstrlenW
GetCurrentProcessId
InterlockedDecrement
DeleteFileA
SetFileAttributesA
GetFileAttributesA
Sleep
CreateProcessA
CreateMutexA
ExitProcess
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
lstrcatA
GetTempPathA
GlobalFree
GlobalAlloc
lstrcpyA
OpenFileMappingA
OpenMutexA
GetLocalTime
GetModuleFileNameA
CopyFileA
GetVersionExA
SetProcessPriorityBoost
SetThreadPriority
GetCurrentThread
SetPriorityClass
GetEnvironmentVariableA
GetShortPathNameA
GetTickCount
GetModuleHandleA
HeapFree
HeapAlloc
GetCommandLineA
GetCommandLineW
FreeResource
GetCurrentProcess
LoadResource
SizeofResource
FindResourceA
LoadLibraryExA
EndUpdateResourceA
UpdateResourceA
BeginUpdateResourceA
FindClose
FindNextFileA
FindFirstFileA
GetVolumeInformationA
GetCurrentDirectoryA
CreateToolhelp32Snapshot
Process32First
Process32Next
RaiseException
FlushFileBuffers
SetStdHandle
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
HeapCreate
HeapDestroy
VirtualAlloc
HeapSize
VirtualFree
LCMapStringW
LCMapStringA
GetOEMCP
GetACP
GetCPInfo
GetVersion
GetStartupInfoA
RtlUnwind
HeapReAlloc
FileTimeToSystemTime
lstrcpynA
GetLastError
LocalFree
GetFileSize
SetFilePointer
ReadFile
CreateFileA
WriteFile
CloseHandle
WideCharToMultiByte
LockResource
lstrlenA
user32
GetWindowThreadProcessId
SendMessageTimeoutA
RegisterWindowMessageA
EnumChildWindows
wsprintfA
GetClassNameA
KillTimer
FindWindowExA
PostMessageA
IsWindow
DefWindowProcA
PostQuitMessage
CreateWindowExA
SetTimer
UpdateWindow
LoadIconA
LoadCursorA
RegisterClassExA
GetDesktopWindow
GetMessageA
TranslateMessage
DispatchMessageA
ShowWindow
advapi32
RegCreateKeyExA
RegSetValueExA
RegCloseKey
shell32
SHGetSpecialFolderPathA
SHChangeNotify
CommandLineToArgvW
SHGetSpecialFolderLocation
SHGetPathFromIDListA
ShellExecuteExA
ole32
CoCreateInstance
OleRun
CoTaskMemFree
CoInitialize
CoUninitialize
oleaut32
SysAllocString
SysFreeString
VariantClear
SysAllocStringLen
oleacc
ObjectFromLresult
wininet
FindNextUrlCacheEntryA
DeleteUrlCacheEntry
FindFirstUrlCacheEntryA
psapi
GetModuleFileNameExA
netapi32
Netbios
Sections
.text Size: 56KB - Virtual size: 55KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 14KB - Virtual size: 222KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ