Static task
static1
Behavioral task
behavioral1
Sample
e1a7fa1bab616c97c60c0bc8fe13b3fa_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e1a7fa1bab616c97c60c0bc8fe13b3fa_JaffaCakes118.exe
Resource
win10v2004-20240910-en
General
-
Target
e1a7fa1bab616c97c60c0bc8fe13b3fa_JaffaCakes118
-
Size
313KB
-
MD5
e1a7fa1bab616c97c60c0bc8fe13b3fa
-
SHA1
fca5cc821579c412f0802d0c906eca59995ce30b
-
SHA256
5f0158a4769a6cfe0904927ca56a5dc2acf3908c39aa4fdcb32244c3715fb0c8
-
SHA512
a06cabd7052d2df589c327093653a72d76189c18d352fc39738bcd3d4c6916e726c1cbfa545320d65a3852f6881854d9b3ae97803e3f9b09ad2f4180f3c9ab11
-
SSDEEP
6144:OSeiuJzYu6x3QL+xjiGAjtn3suHYyR8qgGn/0Yuu:o8w+NiTjV3suHBR3/0Yu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e1a7fa1bab616c97c60c0bc8fe13b3fa_JaffaCakes118
Files
-
e1a7fa1bab616c97c60c0bc8fe13b3fa_JaffaCakes118.exe windows:5 windows x86 arch:x86
61d979f34dedeccdef92488d560659f1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
setupapi
SetupAddInstallSectionToDiskSpaceListW
SetupSetDirectoryIdW
SetupInstallFilesFromInfSectionW
SetupInstallFromInfSectionW
SetupRemoveInstallSectionFromDiskSpaceListW
SetupFindNextLine
SetupGetLineTextW
SetupFindFirstLineW
SetupSetDirectoryIdExW
kernel32
InitializeCriticalSection
DeleteCriticalSection
GetLocalTime
MoveFileW
lstrcmpiW
GetLastError
GetCommandLineW
CloseHandle
CreateFileW
SetCurrentDirectoryW
Sleep
GetVersionExW
GetSystemDirectoryW
GetWindowsDirectoryW
GetComputerNameW
FreeLibrary
LoadLibraryExW
GetFileAttributesW
SetFileAttributesW
MoveFileExW
DeleteFileW
RemoveDirectoryW
FindClose
FindNextFileW
FindFirstFileW
GetSystemInfo
OutputDebugStringW
lstrcatW
LocalFree
FormatMessageW
LocalAlloc
CreateDirectoryW
GetCurrentDirectoryW
GlobalFree
GlobalAlloc
GetCurrentProcess
GetCurrentThread
MultiByteToWideChar
lstrcpyW
GetModuleHandleA
SetLastError
GetEnvironmentVariableW
lstrlenW
lstrcmpW
lstrcpynW
SetEnvironmentVariableW
GetProcAddress
LoadLibraryA
LocalReAlloc
WriteFile
WideCharToMultiByte
lstrlenA
LeaveCriticalSection
EnterCriticalSection
GetModuleFileNameW
ExpandEnvironmentStringsW
advapi32
GetTokenInformation
EqualSid
RegDeleteKeyW
RegEnumValueW
RegEnumKeyExW
RegQueryInfoKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
EnumDependentServicesW
ChangeServiceConfig2W
CreateServiceW
DeleteService
StartServiceW
OpenSCManagerW
OpenServiceW
QueryServiceStatus
ControlService
ChangeServiceConfigW
CloseServiceHandle
GetLengthSid
InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
MakeSelfRelativeSD
GetSecurityDescriptorLength
LookupAccountNameW
AllocateAndInitializeSid
SetEntriesInAclW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetFileSecurityW
FreeSid
RegOpenKeyW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
OpenThreadToken
OpenProcessToken
user32
LoadStringW
MessageBoxW
wsprintfW
LoadBitmapW
clusapi
OpenCluster
ClusterOpenEnum
ClusterEnum
OpenClusterResource
OfflineClusterResource
CloseClusterResource
ClusterCloseEnum
CloseCluster
resutils
ResUtilResourceTypesEqual
ole32
StringFromGUID2
CoInitialize
CoCreateInstance
CoInitializeEx
CoGetClassObject
CoUninitialize
loadperf
LoadPerfCounterTextStringsW
UnloadPerfCounterTextStringsW
Sections
.text Size: 57KB - Virtual size: 56KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 240KB - Virtual size: 395KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ