Static task
static1
Behavioral task
behavioral1
Sample
efc20f02d77e5ea4f689b1d85d225f7d_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
efc20f02d77e5ea4f689b1d85d225f7d_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
efc20f02d77e5ea4f689b1d85d225f7d_JaffaCakes118
-
Size
77KB
-
MD5
efc20f02d77e5ea4f689b1d85d225f7d
-
SHA1
a152202f8f51bbe66e48d140c83730a5b6e0a9f7
-
SHA256
bcbdb7ec004d80cc7027c299bd3c16fdcc67f3f0278044a2fbb81a9691c9520e
-
SHA512
0f7b91c972185802a833f6683eb542a1425cbdbadd37943470ccd087f3643cbf72b571f20b754c422e88e2e381b31865c01bb800beeb726fc9a1d44311318ee1
-
SSDEEP
1536:ScKvaE1KCsb892TDUulmEoco6XYjHty2M:ScKyE8C+89yUuaF0YjNW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource efc20f02d77e5ea4f689b1d85d225f7d_JaffaCakes118
Files
-
efc20f02d77e5ea4f689b1d85d225f7d_JaffaCakes118.exe windows:4 windows x86 arch:x86
e10364ff634f3eb64abaa975484e0e15
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GlobalAlloc
GlobalFree
lstrcpyA
GetVolumeInformationA
GetDiskFreeSpaceA
lstrlenA
RtlZeroMemory
_lclose
_llseek
_lopen
SetErrorMode
ReadFile
GetLongPathNameA
GetSystemTime
DeleteFileA
SetFileAttributesA
lstrcmpiA
GetFileAttributesA
FindNextFileA
FindFirstFileA
FileTimeToLocalFileTime
SystemTimeToFileTime
GetLocalTime
FileTimeToSystemTime
WriteFile
ExitProcess
WideCharToMultiByte
MultiByteToWideChar
CreateMutexA
GetLastError
CreateFileA
GetWindowsDirectoryA
LCMapStringW
LCMapStringA
SetEndOfFile
SetFilePointer
CompareStringW
CloseHandle
CompareStringA
DeviceIoControl
TerminateProcess
GetCurrentProcess
HeapFree
GetTimeZoneInformation
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapAlloc
SetEnvironmentVariableA
HeapReAlloc
LoadLibraryA
GetOEMCP
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetCPInfo
GetACP
GetStringTypeA
SetHandleCount
GetStdHandle
GetFileType
RtlUnwind
GetStringTypeW
SetStdHandle
FlushFileBuffers
GetProcAddress
user32
PostMessageA
wsprintfA
IsWindow
advapi32
RegOpenKeyA
RegCloseKey
RegQueryValueExA
tmapi
ord1
ord4
ord2
clusalgo
ComputeClusterPlacement
FreeOutBuffer
Sections
.text Size: 44KB - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE