Static task
static1
Behavioral task
behavioral1
Sample
db5d62e217de1f95c43af6d28fd7d960_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
db5d62e217de1f95c43af6d28fd7d960_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
db5d62e217de1f95c43af6d28fd7d960_JaffaCakes118
-
Size
163KB
-
MD5
db5d62e217de1f95c43af6d28fd7d960
-
SHA1
a5e37743876616327aa31f0b436f96edb80c159e
-
SHA256
8acef6e791f65517b6e5c27797335b6d95f65c85db7dd02dec2226e0c6b42499
-
SHA512
205c5005ef8018059f6b248fedd88d19c0b5e3c7df78d00b7767bb216c83095195a8a9f361ba39b15a37f4b75734271237b6e250495dc25bb678682dd9ace0c3
-
SSDEEP
3072:VX8B8R2dlXhLn+5KqpXLui3MQCwR74mZaoIrXdAUmO0iXRUJjPpEANu57sO1ydjj:zR8hlnwrt9RdZaoIrXqR0hojxEANu57Y
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource db5d62e217de1f95c43af6d28fd7d960_JaffaCakes118
Files
-
db5d62e217de1f95c43af6d28fd7d960_JaffaCakes118.exe windows:4 windows x86 arch:x86
91c55587490f29d4fe305ebabf492ba5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
AdjustTokenPrivileges
ChangeServiceConfigA
DeleteService
FreeSid
GetSecurityDescriptorControl
GetTokenInformation
InitializeSecurityDescriptor
LookupAccountSidA
OpenProcessToken
RegQueryInfoKeyA
RegQueryValueA
SetServiceStatus
kernel32
CopyFileA
CreateFileA
CreateThread
CreateToolhelp32Snapshot
DeleteAtom
DuplicateHandle
ExitProcess
ExpandEnvironmentStringsA
FindFirstFileA
FreeLibrary
GetACP
GetConsoleCP
GetCurrentProcess
GetCurrentThreadId
GetDateFormatA
GetDriveTypeA
GetEnvironmentStringsA
GetFileAttributesA
GetFileSize
GetFileTime
GetFullPathNameA
GetLastError
GetLocalTime
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetProcessHeap
GetShortPathNameA
GetStartupInfoA
GetStdHandle
GetStringTypeA
GetSystemDirectoryA
GetTempPathA
GetThreadLocale
GetVersion
GetVersionExA
GlobalAlloc
GlobalFree
GlobalLock
GlobalReAlloc
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSection
InterlockedDecrement
IsBadCodePtr
IsBadReadPtr
LCMapStringA
LeaveCriticalSection
LoadLibraryA
LoadResource
LocalFree
MoveFileA
OpenProcess
OutputDebugStringA
QueryPerformanceCounter
ReadProcessMemory
RemoveDirectoryA
ResetEvent
ResumeThread
SetEnvironmentVariableA
SetErrorMode
SetHandleCount
SetLastError
SetPriorityClass
SetUnhandledExceptionFilter
Sleep
TlsGetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
WaitForSingleObject
WideCharToMultiByte
WritePrivateProfileStringA
lstrcmpA
lstrcmpiA
lstrcpynA
lstrlenA
user32
CallWindowProcA
CharPrevA
CharUpperA
CheckRadioButton
EnableWindow
EnumChildWindows
GetMessageA
GetSystemMetrics
GetWindow
GetWindowTextLengthA
InflateRect
LoadBitmapA
LoadIconA
LoadStringA
MessageBoxA
PeekMessageA
PostQuitMessage
RegisterClassExA
ScreenToClient
SendDlgItemMessageA
SetFocus
SetRect
SetTimer
SetWindowPos
SystemParametersInfoA
wsprintfA
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
Sections
.text Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.DATA Size: 115KB - Virtual size: 248KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 15KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ