Static task
static1
Behavioral task
behavioral1
Sample
ef18fa4495106a68af61c1d0d648ba82_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ef18fa4495106a68af61c1d0d648ba82_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
ef18fa4495106a68af61c1d0d648ba82_JaffaCakes118
-
Size
659KB
-
MD5
ef18fa4495106a68af61c1d0d648ba82
-
SHA1
4b693c53b6894266e5e016253bda958ae7c612a8
-
SHA256
aab0204705447fbf2ab759e57a9baebba3c36ea59799b5a774c9265032f502c5
-
SHA512
bf368e77cf8fdb67fb6221e6020149747bfb85f70691954029cd2e42a5b42f98d344cce682ea4796cff14e0b03fd15ce1390b88d8425a279bc2411de15971447
-
SSDEEP
12288:KVi5h23Ks1mQnWattmsbMVSH05SxQiEQ9jmE56r:KVia3p0RzYa+E
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ef18fa4495106a68af61c1d0d648ba82_JaffaCakes118
Files
-
ef18fa4495106a68af61c1d0d648ba82_JaffaCakes118.exe windows:5 windows x86 arch:x86
e0cd36fc4e4f4032fc5cd3323a14cac0
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegEnumKeyW
OpenEventLogW
ClearEventLogA
LogonUserW
InitializeAcl
CryptSignHashW
RegOpenKeyA
ControlService
RegReplaceKeyW
RegSaveKeyA
RegCreateKeyExW
RegUnLoadKeyA
authz
AuthzAddSidsToContext
AuthzInitializeContextFromSid
uxtheme
GetWindowTheme
GetThemeAppProperties
DrawThemeText
GetThemeBackgroundExtent
GetThemeSysFont
GetThemeSysInt
GetThemePosition
IsThemeActive
GetCurrentThemeName
GetThemeFilename
GetThemeEnumValue
CloseThemeData
GetThemeSysBool
GetThemeBackgroundRegion
wtsapi32
WTSFreeMemory
WTSSetSessionInformationW
WTSVirtualChannelRead
WTSWaitSystemEvent
WTSRegisterSessionNotification
WTSQueryUserToken
WTSVirtualChannelPurgeInput
WTSQuerySessionInformationA
WTSSetUserConfigW
WTSEnumerateSessionsW
WTSEnumerateServersA
kernel32
WaitForSingleObject
CreateJobObjectW
GetProcAddress
GetStringTypeW
OpenSemaphoreW
InitializeCriticalSection
GetCommandLineW
MoveFileA
GetModuleHandleA
GetTempPathA
ReadConsoleA
GetProfileSectionA
GetSystemDirectoryA
CreateMailslotA
CreateFileW
GetLogicalDriveStringsA
GetModuleFileNameW
UnmapViewOfFile
GetDateFormatA
GetVersion
LoadLibraryExA
GetExpandedNameA
lstrcmpiA
DeleteFileW
SearchPathW
GetTickCount
GetFileAttributesW
MoveFileExA
GetConsoleAliasA
Sections
.text Size: 48KB - Virtual size: 47KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
.data Size: 30KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 566KB - Virtual size: 566KB
IMAGE_SCN_MEM_READ