Static task
static1
Behavioral task
behavioral1
Sample
d68264e29f549a25bf89b44e18e92929_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
d68264e29f549a25bf89b44e18e92929_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
d68264e29f549a25bf89b44e18e92929_JaffaCakes118
-
Size
208KB
-
MD5
d68264e29f549a25bf89b44e18e92929
-
SHA1
4a4d8123ec5f8c73d53b9e7d89b01e97c43e2daa
-
SHA256
1c956295d4e934e5603219c93c56fc3b50784b59b6910a7764f0ab229cb8c21e
-
SHA512
f09c2a44d97228a9436cd8de9a52a13f57fed46e219d5eda183eee9c7509779f36a893e2ddb8ffd85ec56fad23c635472c13093fd39d03d34b7da706edd886bb
-
SSDEEP
3072:QvR79TBFJkEJC64phd4fP649XaNlyHhEEDAZvvPTgear2BoyyL7kx6N2qQ2:Q3THBEEDqvbgeBXdx6Nz5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d68264e29f549a25bf89b44e18e92929_JaffaCakes118
Files
-
d68264e29f549a25bf89b44e18e92929_JaffaCakes118.exe windows:4 windows x86 arch:x86
bd547c86665802feea853d195cf68e85
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
DeleteFileA
ReleaseMutex
CreateProcessA
GetTempPathA
GetLastError
CreateMutexA
GetModuleFileNameA
CreateDirectoryA
RemoveDirectoryA
GetComputerNameA
WritePrivateProfileStringA
GetSystemTime
GetFileTime
FileTimeToSystemTime
Sleep
GetFileSize
WaitForSingleObject
GetLocalTime
GetDiskFreeSpaceA
SystemTimeToFileTime
CopyFileA
GetWindowsDirectoryA
DeviceIoControl
CompareFileTime
GetPrivateProfileStringA
GetVolumeInformationA
ResumeThread
CreateThread
GetCommandLineW
TerminateProcess
OpenProcess
GetCurrentProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
FindFirstFileA
FindNextFileA
FindClose
SetFileAttributesA
CreateFileA
GetFileAttributesA
GetFileInformationByHandle
CloseHandle
FileTimeToLocalFileTime
FileTimeToDosDateTime
GetDriveTypeA
HeapAlloc
HeapFree
GetFileType
ReadFile
WriteFile
SetFilePointer
RtlUnwind
RaiseException
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
IsBadWritePtr
SetEndOfFile
SetHandleCount
GetStdHandle
SetStdHandle
HeapSize
SetUnhandledExceptionFilter
GetProcAddress
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetCPInfo
GetACP
GetOEMCP
IsBadReadPtr
IsBadCodePtr
FlushFileBuffers
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
LoadLibraryA
LCMapStringA
LCMapStringW
CompareStringA
CompareStringW
SetEnvironmentVariableA
advapi32
RegSetValueExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegOpenKeyExA
shell32
ShellExecuteA
CommandLineToArgvW
cabinet
FCICreate
FCIDestroy
FCIAddFile
FCIFlushCabinet
psapi
EnumProcessModules
GetModuleFileNameExA
Sections
.text Size: 88KB - Virtual size: 88KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 8KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 80KB - Virtual size: 80KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE