_gekelberifin@8
Static task
static1
Behavioral task
behavioral1
Sample
eff0b45360cfd97fe7e4e70c6237990d_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
eff0b45360cfd97fe7e4e70c6237990d_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
eff0b45360cfd97fe7e4e70c6237990d_JaffaCakes118
-
Size
3.7MB
-
MD5
eff0b45360cfd97fe7e4e70c6237990d
-
SHA1
c0e8a9f7106f59cb1467eff1a41704649fcba7e8
-
SHA256
77ff40bd6675c04c54f92e8fd174f02ca2226510c3c20f2eac579ef9dcca00e8
-
SHA512
f5a225a830d66a0f920e5427819cce5fa9252ffcb9e0bf7a4b8f8fcdee72457524ab017c7b25231a7efe4b7d3e2813ec5c16d9f39af5a89f8054f2a9ee64467f
-
SSDEEP
98304:0gKRrcCzJm2ArjkAQGC/HZkPd6trJlUaK9mm1EnR:0geHFIC/HOPdwY9XqR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource eff0b45360cfd97fe7e4e70c6237990d_JaffaCakes118
Files
-
eff0b45360cfd97fe7e4e70c6237990d_JaffaCakes118.exe windows:5 windows x86 arch:x86
5fcdfeb1c3c0323f0647fc2922ca3cc3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
EnumResourceNamesW
OpenFile
lstrlenA
WritePrivateProfileStructA
TlsGetValue
ScrollConsoleScreenBufferW
CreateJobObjectW
OpenSemaphoreA
ConnectNamedPipe
CallNamedPipeW
FreeEnvironmentStringsA
_lclose
GetProcessPriorityBoost
CreateNamedPipeW
ReadConsoleW
WriteFile
GetUserDefaultLangID
GetCommandLineA
SetCommTimeouts
FindResourceExA
GlobalAlloc
LoadLibraryW
Sleep
GetPrivateProfileStructW
GetVersionExW
DeleteVolumeMountPointW
SetConsoleMode
WriteConsoleW
GetBinaryTypeA
lstrcatA
FillConsoleOutputCharacterA
GlobalUnlock
DeactivateActCtx
InterlockedExchange
GlobalUnfix
SetCurrentDirectoryA
GetLastError
IsDBCSLeadByteEx
GetTapeStatus
SetVolumeLabelW
EnterCriticalSection
_hwrite
SetFileApisToOEM
GetLocalTime
OpenMutexA
SetCalendarInfoW
BeginUpdateResourceA
PostQueuedCompletionStatus
WriteProfileSectionW
AddAtomA
GetTapeParameters
WaitForMultipleObjects
GetModuleHandleA
LoadLibraryExA
VirtualProtect
EnumDateFormatsW
GetConsoleCursorInfo
LocalSize
lstrcpyA
SetThreadPriority
FileTimeToDosDateTime
GetStartupInfoA
SetUnhandledExceptionFilter
GetModuleHandleW
GetProcAddress
ExitProcess
GetStdHandle
GetModuleFileNameA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
VirtualAlloc
HeapReAlloc
RtlUnwind
HeapSize
GetLocaleInfoA
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
user32
GetCursorPos
gdi32
GetBitmapDimensionEx
Exports
Exports
Sections
.text Size: 3.7MB - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 3.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.zalecom Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.xakuyan Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 15KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ