Static task
static1
Behavioral task
behavioral1
Sample
d5b97bba0d325394f90395bfc1f8628c_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d5b97bba0d325394f90395bfc1f8628c_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
d5b97bba0d325394f90395bfc1f8628c_JaffaCakes118
-
Size
415KB
-
MD5
d5b97bba0d325394f90395bfc1f8628c
-
SHA1
2a4993cbb5806aacf6e91c97004cac53cb446431
-
SHA256
c22bff8417b399e946e8ad6be7161eef3870e023e765288e6b6dca2d0fe55a74
-
SHA512
9f0190978505dbaeed7ba19827ec774c0bc216db1af5f2fa4b7a172314d20daa038cf8c2617c5fda0b9bfe51e0c80324f2e64a9522fc3637553799c0b93f0a2b
-
SSDEEP
6144:TbN/zcRD56jb82iHRehSCXCz5ffoFet8LExdt26Bgmpe7QFkyPdpV:npzcB8jb82Y1w7ExdyQFk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d5b97bba0d325394f90395bfc1f8628c_JaffaCakes118
Files
-
d5b97bba0d325394f90395bfc1f8628c_JaffaCakes118.exe windows:4 windows x86 arch:x86
b0abf0ba345a8bb20a039621ce022965
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
CryptGetProvParam
LogonUserA
CryptSetProviderW
LookupPrivilegeNameA
StartServiceA
CryptGetDefaultProviderA
GetUserNameA
DuplicateToken
CryptEnumProvidersW
RegQueryInfoKeyW
RegRestoreKeyA
RegEnumKeyExA
CryptEnumProviderTypesW
InitializeSecurityDescriptor
LookupPrivilegeDisplayNameW
RegSetValueA
wininet
FtpRemoveDirectoryA
HttpEndRequestW
InternetCreateUrlW
FtpOpenFileW
InternetCloseHandle
FindFirstUrlCacheEntryA
DeleteUrlCacheEntryW
InternetSetOptionA
GetUrlCacheConfigInfoW
GopherFindFirstFileW
HttpEndRequestA
GopherGetAttributeW
GopherCreateLocatorA
InternetSetFilePointer
GopherGetAttributeA
SetUrlCacheHeaderData
InternetAlgIdToStringA
UrlZonesDetach
FindCloseUrlCache
GetUrlCacheGroupAttributeA
FtpGetFileEx
CreateUrlCacheContainerA
FindNextUrlCacheGroup
DeleteUrlCacheContainerW
comdlg32
PrintDlgW
ChooseFontA
GetFileTitleW
GetSaveFileNameA
PrintDlgA
ChooseFontW
ChooseColorW
GetOpenFileNameW
FindTextA
ReplaceTextW
FindTextW
GetFileTitleA
GetOpenFileNameA
PageSetupDlgA
GetSaveFileNameW
PageSetupDlgW
ReplaceTextA
user32
DefWindowProcA
CharToOemBuffW
DdeFreeDataHandle
OemToCharW
DefFrameProcW
GetWindowRect
MapVirtualKeyW
CreatePopupMenu
DlgDirListComboBoxA
GetClassInfoA
LoadCursorA
GetProcessDefaultLayout
GetWindowContextHelpId
RedrawWindow
GetWindow
DispatchMessageW
InvalidateRect
RegisterHotKey
kernel32
RtlUnwind
ConnectNamedPipe
GetTickCount
LCMapStringW
GetFileType
ExitProcess
GetUserDefaultLCID
GetEnvironmentStrings
GetStartupInfoA
GetStdHandle
IsBadWritePtr
HeapSize
HeapReAlloc
LeaveCriticalSection
GetCurrentThread
GetEnvironmentStringsW
GetConsoleScreenBufferInfo
GetCPInfo
GetModuleHandleA
GetACP
HeapCreate
FreeEnvironmentStringsW
EnumSystemCodePagesW
EnterCriticalSection
GetProcAddress
WriteFile
MapViewOfFile
VirtualAlloc
IsValidCodePage
HeapDestroy
TlsFree
CompareStringA
InterlockedExchange
DeleteCriticalSection
VirtualProtect
MapViewOfFileEx
CreateProcessW
GetOEMCP
GetDateFormatA
GetStringTypeW
GetSystemInfo
HeapAlloc
SetHandleCount
HeapFree
GetFileAttributesExW
GetCurrentThreadId
GetTimeFormatW
GetTimeFormatA
TlsAlloc
CreatePipe
LCMapStringA
GetModuleFileNameA
GetStringTypeA
GetCurrentProcess
TlsGetValue
FreeEnvironmentStringsA
IsValidLocale
GetLastError
UnhandledExceptionFilter
EnumSystemLocalesA
TlsSetValue
GetLocaleInfoW
SetEnvironmentVariableA
CompareStringW
VirtualFree
SetLastError
TerminateProcess
GetProcessShutdownParameters
WideCharToMultiByte
LoadLibraryA
GetVersionExA
GetCommandLineA
AddAtomA
GetLocaleInfoA
GlobalGetAtomNameW
VirtualQuery
GetCurrentProcessId
MultiByteToWideChar
GetLogicalDriveStringsW
QueryPerformanceCounter
InitializeCriticalSection
GetTimeZoneInformation
GetSystemTimeAsFileTime
SystemTimeToFileTime
gdi32
GetMiterLimit
Arc
GetCharWidthFloatA
CreateBitmapIndirect
PolyTextOutW
GetClipBox
StretchDIBits
SetPixelFormat
CreateDIBitmap
GetEnhMetaFileW
SetWinMetaFileBits
Chord
ResetDCW
SetColorSpace
Sections
.text Size: 128KB - Virtual size: 127KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 276KB - Virtual size: 293KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ