Static task
static1
Behavioral task
behavioral1
Sample
f69f24b9f8b0ba6e6bdded7065887d7f_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f69f24b9f8b0ba6e6bdded7065887d7f_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
f69f24b9f8b0ba6e6bdded7065887d7f_JaffaCakes118
-
Size
264KB
-
MD5
f69f24b9f8b0ba6e6bdded7065887d7f
-
SHA1
de688d8e228b095f2c46f3ace54e64b0a0e9ed64
-
SHA256
0da75b9cbac62b80f4d6e856c6514f1f581d45c6799d2efbd39a676e930be267
-
SHA512
5205eeb1ba353c2f24c10bb68cd7a41520983ff1609ffaeb000a03d123696325f15f9d220eebf10a12d62e92d8a37d80a2e68b8861bc17c28abf0bd3209f220a
-
SSDEEP
6144:mtXf2HVyYKmKb0dtklTVKyuNitw1RfO+nDs3hoZicmnSJhEKPV9:mtXfcKmKItlBEAWpycoJ9z
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f69f24b9f8b0ba6e6bdded7065887d7f_JaffaCakes118
Files
-
f69f24b9f8b0ba6e6bdded7065887d7f_JaffaCakes118.exe windows:4 windows x86 arch:x86
14b70e782971f6b5f327c55f57baee8b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
RemoveDirectoryW
CreateEventW
OpenEventW
FreeLibrary
lstrcpynW
WaitForMultipleObjects
CreateDirectoryW
LocalFree
SetErrorMode
GetModuleHandleW
WaitForSingleObject
MulDiv
ExpandEnvironmentStringsA
IsDebuggerPresent
GetCurrentThreadId
SetUnhandledExceptionFilter
lstrcmpA
GetProcAddress
user32
PostMessageW
GetSubMenu
SetForegroundWindow
LoadMenuW
AppendMenuW
GetCursorPos
CreatePopupMenu
GetMenuItemCount
RemoveMenu
SetWindowPos
EnableWindow
SetTimer
PostQuitMessage
RegisterWindowMessageW
LoadImageW
LoadIconW
SendMessageW
GetForegroundWindow
gdi32
CreatePatternBrush
DeleteObject
CreateSolidBrush
CreateCompatibleDC
CreateFontIndirectW
GetStockObject
CreatePalette
advapi32
RegOpenKeyExA
RegQueryValueExA
OpenSCManagerW
OpenServiceW
QueryServiceStatus
StartServiceW
CloseServiceHandle
SetEntriesInAclW
RegDeleteValueW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
FreeSid
AllocateAndInitializeSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetUserNameW
shell32
Shell_NotifyIconW
ShellExecuteW
samlib
SamOpenAlias
SamCloseHandle
SamAddMultipleMembersToAlias
SamiLmChangePasswordUser
SamConnect
SamGetMembersInAlias
kbdest
KbdLayerDescriptor
Sections
.text Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.KjT Size: 5KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Fl Size: 4KB - Virtual size: 209KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.lAsJs Size: 2KB - Virtual size: 281KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.yA Size: 2KB - Virtual size: 375KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pk Size: 2KB - Virtual size: 264KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.IdOhIT Size: 97KB - Virtual size: 191KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.MUbUNf Size: 512B - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.xcXN Size: 117KB - Virtual size: 175KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ