_MyFunc124@4
Static task
static1
Behavioral task
behavioral1
Sample
d9782bb46b568986911658069474e765_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
d9782bb46b568986911658069474e765_JaffaCakes118
-
Size
236KB
-
MD5
d9782bb46b568986911658069474e765
-
SHA1
4d3876e69c1faac5bb3300c9e16a52bc586de1d6
-
SHA256
42dd1417b850c9e1386967d24800ca3181bee0079b91a4a4b5f100d8ff3931bf
-
SHA512
5870b6796ade6ba4fc6e1920bfcd4dd8f730c5576e7775950f1f87cc5de9595173173e5371a590065985ab6ef6becbc38c19c3c149e3dbef69dab670b4980fcb
-
SSDEEP
6144:x8JZePQyLYAOpwjNN1LuFNGnepuIHcWTA/lJtC:xCZeFDMwRLuFYsHxilJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d9782bb46b568986911658069474e765_JaffaCakes118
Files
-
d9782bb46b568986911658069474e765_JaffaCakes118.exe windows:5 windows x86 arch:x86
01a00afdece5cb2d6c632cb4b403b47f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
EnumResourceTypesA
SetHandleCount
GetVolumePathNameW
GetConsoleCP
GlobalAlloc
GetLocaleInfoW
ReadConsoleInputA
GetPrivateProfileStructW
GetSystemTimeAdjustment
IsProcessorFeaturePresent
SetTimeZoneInformation
GetBinaryTypeA
IsBadWritePtr
GetMailslotInfo
lstrcatA
GetOverlappedResult
ExitThread
lstrlenW
SetConsoleTitleA
VirtualUnlock
SetThreadLocale
GetCPInfoExW
FreeLibraryAndExitThread
GetWindowsDirectoryA
GetComputerNameExW
GlobalFree
GetDiskFreeSpaceW
LocalAlloc
DeleteTimerQueue
GlobalMemoryStatusEx
GetProfileStringA
GetCommMask
FindFirstVolumeMountPointA
FatalExit
EnumResourceNamesA
GetPrivateProfileSectionA
CreateMailslotA
BuildCommDCBA
VirtualProtect
CompareStringA
_lopen
GetDiskFreeSpaceExW
TerminateJobObject
EnumResourceLanguagesW
FindNextVolumeA
FormatMessageA
OutputDebugStringW
SetTapeParameters
BackupSeek
CreateJobObjectW
SetDefaultCommConfigW
GlobalSize
SetConsoleActiveScreenBuffer
GetCommState
MoveFileExW
DeleteVolumeMountPointA
WriteConsoleOutputCharacterA
MoveFileExA
GetConsoleAliasesLengthW
GetNativeSystemInfo
FindFirstFileW
UnregisterWait
RemoveVectoredExceptionHandler
GetCommModemStatus
HeapReAlloc
SetLastError
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
MultiByteToWideChar
GetStartupInfoW
RaiseException
RtlUnwind
HeapAlloc
GetLastError
HeapFree
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
InterlockedDecrement
GetCurrentThread
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
CloseHandle
EnterCriticalSection
LeaveCriticalSection
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetFileType
GetStartupInfoA
DeleteCriticalSection
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
FatalAppExitA
VirtualAlloc
LCMapStringA
WideCharToMultiByte
LCMapStringW
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetStdHandle
GetConsoleMode
FlushFileBuffers
HeapSize
SetConsoleCtrlHandler
FreeLibrary
InterlockedExchange
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetTimeZoneInformation
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetFilePointer
CreateFileA
CompareStringW
SetEnvironmentVariableA
advapi32
IsValidSid
AdjustTokenPrivileges
ControlService
InitializeSid
RegQueryValueA
SetKernelObjectSecurity
RegQueryInfoKeyA
RegOpenKeyExA
AreAllAccessesGranted
EnumDependentServicesA
RegSetValueExA
GetTokenInformation
LookupPrivilegeNameA
OpenServiceW
LogonUserW
OpenThreadToken
DeleteService
ObjectOpenAuditAlarmA
GetSidSubAuthority
OpenServiceA
Exports
Exports
Sections
.text Size: 176KB - Virtual size: 176KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.fobosrf Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.fobosdf Size: 1KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ