Static task
static1
Behavioral task
behavioral1
Sample
f4f8ed0d68cc6573021d4b6f3e495ee2_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f4f8ed0d68cc6573021d4b6f3e495ee2_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
f4f8ed0d68cc6573021d4b6f3e495ee2_JaffaCakes118
-
Size
970KB
-
MD5
f4f8ed0d68cc6573021d4b6f3e495ee2
-
SHA1
a2dbbcbfd5cec333d9297d1e36a64cb6c1d86edb
-
SHA256
bf055e0f04414846fbfc039867115422f818bfb2b146ab12b965ec070a1c19d2
-
SHA512
f81d61b142a102076b972b50e581a9794c5968d3c5f95261b17eda59eccc9b166f00a80fb060e07b3bc9ddc0fb31a9168e2ec347524daefca0e4021587c66b00
-
SSDEEP
24576:Wz0v09F1DrAIe6w0zpKlp+eSO/oA9QBYBjvwfg:G0cF/AW4df2BYt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource f4f8ed0d68cc6573021d4b6f3e495ee2_JaffaCakes118
Files
-
f4f8ed0d68cc6573021d4b6f3e495ee2_JaffaCakes118.exe windows:5 windows x86 arch:x86
aa4ec607a31f5eea10eb866528c3562a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
TerminateThread
GlobalAlloc
AddAtomA
ExitProcess
GetSystemTimes
EncodePointer
CreateFileW
ReadConsoleW
GetModuleFileNameW
GetProcessAffinityMask
GetCPInfo
VirtualProtect
GetTickCount
GetProcessWorkingSetSize
ReadFile
WriteConsoleW
SetFilePointerEx
HeapReAlloc
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
TerminateProcess
RaiseException
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
GetStdHandle
WriteFile
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
GetModuleHandleExW
GetACP
HeapFree
HeapAlloc
LCMapStringW
GetFileType
GetStringTypeW
CloseHandle
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetProcessHeap
FlushFileBuffers
GetConsoleCP
GetConsoleMode
HeapSize
DecodePointer
user32
CopyImage
LoadImageW
advapi32
InitiateSystemShutdownW
GetSecurityDescriptorControl
OpenEventLogA
GetUserNameW
LookupPrivilegeNameA
winhttp
WinHttpCreateUrl
WinHttpCloseHandle
WinHttpOpen
Sections
.text Size: 104KB - Virtual size: 103KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 860KB - Virtual size: 859KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ