Static task
static1
Behavioral task
behavioral1
Sample
d9a96092e45311f8f38f1d31aab7de85_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
d9a96092e45311f8f38f1d31aab7de85_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
d9a96092e45311f8f38f1d31aab7de85_JaffaCakes118
-
Size
277KB
-
MD5
d9a96092e45311f8f38f1d31aab7de85
-
SHA1
0a0c97fee85c600077c59b959472d37f1b9ebc7d
-
SHA256
733fed4590bfe37e7cf9483eb2b463b2ec75caa3d97f1d98b0dc00b592dbff8b
-
SHA512
68c4dccfc29f2b9f5972416aecae2339156a5f0c784e71d6db4d40a3f06ec92bf920b832ef1edc0689c638d73d708646641a08b84609603e1887de5804c6ccd8
-
SSDEEP
6144:VV1VjlMindSC/xSAZ21ICSFjmf9fWDCxS2K0naW+tIqlnlkka:V1jlMiSGxBUVSFmf9fx2G4eu6r
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d9a96092e45311f8f38f1d31aab7de85_JaffaCakes118
Files
-
d9a96092e45311f8f38f1d31aab7de85_JaffaCakes118.exe windows:4 windows x86 arch:x86
330f2c5dace9c3041f0ad21343d6373a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetWindowsDirectoryA
lstrcpyA
ExpandEnvironmentStringsA
lstrcpyW
ExpandEnvironmentStringsW
GetCurrentThreadId
GetSystemInfo
GetModuleHandleW
GetTempPathA
GetTempFileNameA
SetErrorMode
OpenEventA
OpenMutexA
OpenSemaphoreA
CreateEventA
GetSystemDirectoryA
CreateSemaphoreA
SleepEx
QueryPerformanceFrequency
SetUnhandledExceptionFilter
CreateSemaphoreW
WaitForSingleObject
GetModuleHandleA
FreeLibrary
GetProcessHeap
CreateMutexA
IsDebuggerPresent
GetStartupInfoW
GetProcAddress
user32
GetSystemMetrics
wsprintfA
CharUpperA
CharLowerA
CharUpperW
CharLowerW
advapi32
DuplicateTokenEx
GetUserNameA
LookupAccountSidA
LookupPrivilegeValueA
AdjustTokenPrivileges
GetTokenInformation
EqualSid
InitializeAcl
AddAccessAllowedAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetSecurityDescriptorSacl
AllocateAndInitializeSid
GetLengthSid
FreeSid
CopySid
OpenThreadToken
ImpersonateLoggedOnUser
OpenProcessToken
DuplicateToken
SetThreadToken
RevertToSelf
shlwapi
PathUnExpandEnvStringsW
PathUnExpandEnvStringsA
rtutils
RouterLogRegisterW
RouterLogEventW
RouterLogDeregisterW
TraceVprintfExW
LogEventW
iyuv_32
DllMain
AboutDialogProc
Sections
.text Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.ui Size: 4KB - Virtual size: 539KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.TRYlp Size: 99KB - Virtual size: 120KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.DZ Size: 1KB - Virtual size: 97KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 2KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.qsdP Size: 1024B - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 7KB - Virtual size: 178KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.GRSLe Size: 115KB - Virtual size: 136KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.FmqEgM Size: 3KB - Virtual size: 184KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ