Static task
static1
Behavioral task
behavioral1
Sample
deb602d6e3ac2f0788eb9afac0bd077f_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
deb602d6e3ac2f0788eb9afac0bd077f_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
deb602d6e3ac2f0788eb9afac0bd077f_JaffaCakes118
-
Size
667KB
-
MD5
deb602d6e3ac2f0788eb9afac0bd077f
-
SHA1
5935e66c1fdac29b0890eb80b93e8d101fd4e9de
-
SHA256
0c45b11b58a5674b0fb5b93fa8abd08df0e7a25f7b6e11d6cca0dddf9f22cd98
-
SHA512
94e2825e3924801addcce0e1d18f98e70a25f5f559531c3b34d7b0c51209045efd9047fb9d659b8278e7df81d9d15d813cef6714005466c4d66d8b99e046980f
-
SSDEEP
12288:CPScAkF4D8+Knu4tsHKWZsglJvua5Kk3M0iQT2jAci6QnUYXIM4:EAonu4tIx4FhQUAgt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource deb602d6e3ac2f0788eb9afac0bd077f_JaffaCakes118
Files
-
deb602d6e3ac2f0788eb9afac0bd077f_JaffaCakes118.exe windows:6 windows x86 arch:x86
c65ddf4083cf5d88cedfb7e82925052c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
StrCpyNW
netapi32
NetApiBufferFree
NetWkstaGetInfo
wininet
InternetCheckConnectionW
kernel32
SetWaitableTimer
LeaveCriticalSection
EnterCriticalSection
TlsFree
TlsAlloc
TlsSetValue
TlsGetValue
CloseHandle
WaitForSingleObject
SleepEx
SetEvent
CreateEventW
QueueUserAPC
TerminateThread
WaitForMultipleObjects
DeleteCriticalSection
CreateIoCompletionPort
InitializeCriticalSectionAndSpinCount
VerifyVersionInfoW
VerSetConditionMask
GetNativeSystemInfo
GetCurrentProcess
SetLastError
CopyFileW
lstrlenW
GetTempFileNameW
GetTickCount
CreateMutexW
CreateMutexA
ExitProcess
DeleteFileW
RemoveDirectoryW
AllocConsole
SetConsoleTextAttribute
GetStdHandle
WriteConsoleW
ReadConsoleInputW
FreeConsole
GetLocalTime
OpenEventW
InitializeCriticalSection
GetModuleHandleA
VirtualProtect
lstrcmp
GetModuleFileNameW
CreateProcessW
GetModuleHandleW
GetProcessHeap
GetQueuedCompletionStatus
PostQueuedCompletionStatus
MoveFileExW
GetTickCount64
GetLastError
SetStdHandle
ReadConsoleW
HeapSize
GlobalMemoryStatusEx
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
GetTimeZoneInformation
HeapReAlloc
ReadFile
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
HeapAlloc
HeapFree
WriteFile
SetEnvironmentVariableW
GetCommandLineW
GetCommandLineA
GetModuleHandleExW
ExitThread
RaiseException
RtlUnwind
LoadLibraryW
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
WideCharToMultiByte
DuplicateHandle
WaitForSingleObjectEx
Sleep
SwitchToThread
GetCurrentThread
GetCurrentThreadId
QueryPerformanceCounter
TryEnterCriticalSection
MultiByteToWideChar
CreateFileW
FindClose
FindFirstFileExW
FindNextFileW
SetFilePointerEx
AreFileApisANSI
EncodePointer
DecodePointer
GetSystemTimeAsFileTime
GetProcAddress
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
LocalFree
FormatMessageA
GetEnvironmentVariableW
GetFileAttributesW
DeviceIoControl
GetWindowsDirectoryW
ResetEvent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
CreateTimerQueue
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibrary
FreeLibraryAndExitThread
LoadLibraryExW
GetVersionExW
VirtualAlloc
VirtualFree
advapi32
RegDeleteValueW
CryptGenRandom
CryptReleaseContext
CryptAcquireContextW
RegDeleteTreeW
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
GetTokenInformation
OpenProcessToken
shell32
SHGetFolderPathAndSubDirW
ole32
CoInitializeSecurity
CoUninitialize
CoCreateGuid
StringFromGUID2
CoInitializeEx
CoCreateInstance
oleaut32
VariantInit
VariantClear
SysFreeString
SysAllocString
ws2_32
WSASetLastError
WSAGetLastError
closesocket
WSACleanup
getaddrinfo
freeaddrinfo
ioctlsocket
select
connect
shutdown
htonl
ntohl
htons
setsockopt
getsockopt
WSACloseEvent
WSAEventSelect
WSASocketW
WSAStartup
WSARecv
WSASend
WSACreateEvent
Sections
.text Size: 509KB - Virtual size: 509KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 115KB - Virtual size: 114KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 15KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
init Size: 512B - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ