Static task
static1
Behavioral task
behavioral1
Sample
ef35ccc4762b8f6d19acb928b8a51583_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ef35ccc4762b8f6d19acb928b8a51583_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
ef35ccc4762b8f6d19acb928b8a51583_JaffaCakes118
-
Size
628KB
-
MD5
ef35ccc4762b8f6d19acb928b8a51583
-
SHA1
1a2acf88a4f081e0f53e205ca6b8a920e0279e4a
-
SHA256
48beaee37b9c50de453f632f0c507a4ff7929e917aedbdbf39fef1989ee0f4fa
-
SHA512
be4eccdd7543d778fe8825840232ac5f334f42c51cda20da24e31faaaf2f087d95fe46be3a8fda39767c01324732a5e92356f327d1bb71beff4b76a5856b4ac2
-
SSDEEP
12288:G/iOXpu4Wo/WfTcFXXZyGSMRjt7vnt0lFCkj5+aKac4zbTa5Tp7T:0pGKXgGSMqd8ac79f
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ef35ccc4762b8f6d19acb928b8a51583_JaffaCakes118
Files
-
ef35ccc4762b8f6d19acb928b8a51583_JaffaCakes118.exe windows:4 windows x86 arch:x86
0e3648252d7d9574a7fdcbf626ccd4d3
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrcmpiA
ConnectNamedPipe
GlobalGetAtomNameW
VirtualQueryEx
FindFirstFileExW
ExitThread
GlobalDeleteAtom
MoveFileExA
CreateProcessA
GetEnvironmentStringsW
VirtualQuery
GetCurrentProcessId
IsBadReadPtr
DosDateTimeToFileTime
_llseek
UnmapViewOfFile
VirtualLock
GetPrivateProfileStringW
GetOEMCP
LeaveCriticalSection
GetPrivateProfileSectionW
EnumSystemCodePagesW
GetAtomNameA
FormatMessageW
SetEnvironmentVariableW
GetCompressedFileSizeW
CreateDirectoryW
SetEndOfFile
GetCommModemStatus
RaiseException
SetSystemTime
IsBadWritePtr
CompareStringW
GlobalFindAtomW
WritePrivateProfileStringW
FreeLibrary
DuplicateHandle
EnumDateFormatsW
VirtualAlloc
CloseHandle
GetFileType
SetThreadPriorityBoost
FindFirstFileW
GetShortPathNameA
OutputDebugStringW
GlobalReAlloc
PeekConsoleInputW
SetFileAttributesA
CreateFileW
EnumSystemCodePagesA
SetConsoleTitleA
GenerateConsoleCtrlEvent
CopyFileExW
GetFileAttributesExA
GetHandleInformation
GetTapeParameters
ReleaseMutex
GetBinaryTypeW
SetProcessAffinityMask
SetMailslotInfo
RemoveDirectoryW
SetCurrentDirectoryA
CreateDirectoryA
WriteProcessMemory
GetStartupInfoA
GetTickCount
SetThreadLocale
LocalReAlloc
CreateMutexW
DeleteFiber
GetProfileStringA
SetProcessWorkingSetSize
VirtualAllocEx
SetCommTimeouts
LocalLock
FindResourceExW
PulseEvent
ReadConsoleInputW
ExitProcess
GetTempPathW
OutputDebugStringA
WriteFile
GetLogicalDriveStringsA
SearchPathW
user32
PeekMessageW
FindWindowW
GetAncestor
OpenWindowStationW
AppendMenuW
InvalidateRect
DrawStateA
UnregisterClassW
GetClassLongW
DrawIconEx
GetQueueStatus
AppendMenuA
GetDesktopWindow
LoadBitmapW
PostMessageA
gdi32
GetTextMetricsW
CreateICA
PatBlt
GetTextFaceW
comdlg32
CommDlgExtendedError
GetSaveFileNameW
advapi32
CryptAcquireContextW
RegUnLoadKeyA
RegCreateKeyW
GetSidSubAuthority
GetFileSecurityA
GetCurrentHwProfileW
CryptImportKey
GetSidIdentifierAuthority
RegNotifyChangeKeyValue
RegLoadKeyA
EnumServicesStatusW
RegQueryInfoKeyA
CryptReleaseContext
GetSecurityInfo
shell32
Shell_NotifyIconW
SHGetDesktopFolder
SHGetSpecialFolderPathA
SHChangeNotify
SHAddToRecentDocs
ExtractIconExW
DragQueryPoint
Shell_NotifyIconA
FindExecutableW
oleaut32
SafeArrayPutElement
SysAllocStringLen
SafeArrayRedim
SysFreeString
SysStringLen
LoadTypeLi
LoadTypeLibEx
SafeArrayCreate
SetErrorInfo
SafeArrayGetLBound
comctl32
ImageList_LoadImageW
ImageList_GetBkColor
_TrackMouseEvent
CreatePropertySheetPageW
msvcrt
_wputenv
isprint
_wsplitpath
_mbsnbcnt
_ultow
_access
_wremove
wcstol
_errno
_locking
wcsspn
_mbsnicmp
_ismbblead
_chdir
_cwait
_fullpath
freopen
_wgetcwd
frexp
fopen
strerror
_mbsncmp
_strnicoll
wscanf
iswspace
_wcsnset
srand
_isctype
wcstoul
_close
_strupr
strrchr
fflush
_wcsupr
_strrev
_spawnv
_isatty
_get_osfhandle
ungetc
printf
iswalpha
setvbuf
_controlfp
_getcwd
_mbsnbcat
fgetws
atol
rename
iswalnum
toupper
gmtime
_mbsnbcpy
mktime
fwprintf
_wchdir
_ultoa
strstr
_ui64tow
Sections
.text Size: 7KB - Virtual size: 223KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 260KB - Virtual size: 259KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ