Static task
static1
Behavioral task
behavioral1
Sample
e137b9438b65f71a29b28795a768ead3_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e137b9438b65f71a29b28795a768ead3_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
e137b9438b65f71a29b28795a768ead3_JaffaCakes118
-
Size
57KB
-
MD5
e137b9438b65f71a29b28795a768ead3
-
SHA1
acaff873dd9a27bf9d49976bf4fb6016f6d63e68
-
SHA256
d76c1ab8cb4f7252ec9be62a3036e1d478f889f513a07e046b64c5dd4887e17e
-
SHA512
0eb2e3a4ec2d85ddaa879ffc9535715d313b412f26d7f538165bc5e23a28cd1ebe109133ce036215f4cb01f7fb58f8c66fc11f1ee56958cc53e5c2dc2f5868bd
-
SSDEEP
1536:bi2WjncIgY+ieHv4Bek5weBSXtqle1T7wnam:+2WTQ1QBekBYXtqgBkr
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e137b9438b65f71a29b28795a768ead3_JaffaCakes118
Files
-
e137b9438b65f71a29b28795a768ead3_JaffaCakes118.exe windows:4 windows x86 arch:x86
c28c37093af0adb922247533c0473507
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
ControlService
GetSecurityDescriptorControl
InitializeSecurityDescriptor
LockServiceDatabase
RegCreateKeyExA
RegEnumKeyExA
RegEnumValueA
RegOpenKeyA
UnlockServiceDatabase
kernel32
CreateDirectoryA
CreateFileA
CreateFileMappingA
CreateThread
CreateToolhelp32Snapshot
DeleteCriticalSection
DisableThreadLibraryCalls
DuplicateHandle
EnterCriticalSection
ExitProcess
ExpandEnvironmentStringsA
FormatMessageA
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetConsoleOutputCP
GetCurrentDirectoryA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDateFormatA
GetEnvironmentVariableA
GetLastError
GetLocalTime
GetModuleFileNameA
GetModuleHandleA
GetPrivateProfileSectionNamesA
GetPrivateProfileStringA
GetProcAddress
GetProcessHeap
GetStartupInfoA
GetStdHandle
GetStringTypeA
GetSystemDirectoryA
GetTempFileNameA
GetTickCount
GetTimeFormatA
GetVersionExA
GlobalAlloc
GlobalReAlloc
GlobalUnlock
HeapCreate
HeapDestroy
InitializeCriticalSection
InterlockedCompareExchange
InterlockedIncrement
IsBadCodePtr
IsBadWritePtr
IsDebuggerPresent
IsValidCodePage
IsValidLocale
LeaveCriticalSection
LoadLibraryA
LoadLibraryExA
LoadResource
LocalFree
MoveFileExA
QueryPerformanceCounter
RaiseException
ReadProcessMemory
ReleaseMutex
RemoveDirectoryA
SetEvent
SetFilePointer
SetLastError
SetStdHandle
SetThreadPriority
SetUnhandledExceptionFilter
SystemTimeToFileTime
TlsAlloc
TlsGetValue
UnhandledExceptionFilter
UnmapViewOfFile
VirtualQuery
lstrlenA
user32
DestroyIcon
DestroyWindow
DrawTextA
FillRect
FindWindowA
GetDC
GetMenuItemCount
GetMessagePos
GetParent
GetWindowDC
IsWindowEnabled
LoadImageA
MapWindowPoints
MessageBoxA
MoveWindow
RegisterClipboardFormatA
RegisterWindowMessageA
SendDlgItemMessageA
SetCapture
SetRect
SetWindowLongA
SetWindowRgn
ShowWindow
TranslateMessage
UnregisterClassA
wsprintfA
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
Sections
.text Size: 23KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.CRT Size: 13KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.edata Size: 15KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ