Static task
static1
Behavioral task
behavioral1
Sample
f7230c4120a527a1e59d7f13ad092e56_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
f7230c4120a527a1e59d7f13ad092e56_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
f7230c4120a527a1e59d7f13ad092e56_JaffaCakes118
-
Size
655KB
-
MD5
f7230c4120a527a1e59d7f13ad092e56
-
SHA1
76b0dfea537982c844efed68f24438446ce99b00
-
SHA256
b649158171cf7ad81e3d35cf5beaff9edbe882e72ce02e41fdb1b54cab4522af
-
SHA512
8196d46d78a0c283d3228277c8e1607eec96cf55837715a07d5029012ce718d778fe03a434b6476f13c68d7abc6384120f3c6b1bfbf1cd2a939fa5f059298d4b
-
SSDEEP
12288:JkgxQNp5At/ZMZlS4VNCzvQAAwQJWaV0INCfeqmSkt9Pm2Ev+0reEROBfUlFi:JkgxQNp5AzMZ3VNCzvcwQJTuINyez9PV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f7230c4120a527a1e59d7f13ad092e56_JaffaCakes118
Files
-
f7230c4120a527a1e59d7f13ad092e56_JaffaCakes118.exe windows:4 windows x86 arch:x86
64a509988fd3bccf13e6d939767ec4f0
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
LoadLibraryA
IsBadWritePtr
MultiByteToWideChar
GetCommandLineA
SetStdHandle
InterlockedIncrement
GetCurrentProcessId
HeapAlloc
SetHandleCount
WriteFile
HeapFree
InterlockedDecrement
GetCurrentProcess
SetConsoleTitleW
VirtualQuery
GetTickCount
GetFileType
EnterCriticalSection
GetTimeZoneInformation
InitializeCriticalSection
GetStdHandle
SetConsoleMode
HeapCreate
GetExitCodeProcess
GetEnvironmentStrings
VirtualFree
CreateMutexA
OpenMutexA
OpenSemaphoreA
SetLastError
GetACP
CompareStringW
WideCharToMultiByte
FlushFileBuffers
GetSystemTimeAsFileTime
GetStringTypeA
GetSystemTime
TlsSetValue
ReleaseSemaphore
GetCPInfo
ExitProcess
VirtualProtect
LCMapStringW
TlsGetValue
SetEnvironmentVariableA
TerminateProcess
GetModuleHandleA
WriteProfileSectionW
GetCurrentThread
FreeEnvironmentStringsA
RtlUnwind
HeapReAlloc
GetVersion
UnhandledExceptionFilter
GetStringTypeW
GetLastError
LeaveCriticalSection
GetOEMCP
GetModuleFileNameA
LCMapStringA
GetStartupInfoA
HeapDestroy
GlobalGetAtomNameA
DeleteCriticalSection
SetFilePointer
TlsAlloc
Sleep
GetCurrentThreadId
GetLocalTime
GetProcAddress
QueryPerformanceCounter
InterlockedExchange
TlsFree
WaitNamedPipeA
FreeEnvironmentStringsW
LocalAlloc
CompareStringA
GetEnvironmentStringsW
ReadFile
VirtualAlloc
FreeLibraryAndExitThread
advapi32
StartServiceW
LookupPrivilegeValueW
CryptDuplicateKey
RegSetValueExA
LookupPrivilegeNameW
CryptSetKeyParam
GetUserNameW
InitiateSystemShutdownA
RegEnumKeyW
CryptAcquireContextA
RegEnumKeyExA
DuplicateTokenEx
CryptVerifySignatureW
RegCreateKeyW
CryptEnumProviderTypesA
RegSetKeySecurity
CryptHashSessionKey
RegQueryInfoKeyA
GetUserNameA
RegCreateKeyA
RegEnumValueW
CryptEnumProviderTypesW
comdlg32
GetSaveFileNameA
PrintDlgA
PageSetupDlgW
ChooseFontW
comctl32
InitCommonControlsEx
user32
OemKeyScan
GetCursor
PostThreadMessageA
GetMessageA
DeferWindowPos
GetKeyboardType
GetWindow
GetFocus
GetKBCodePage
CharPrevExA
SetDlgItemTextA
GetClassWord
EnumDisplaySettingsA
ShowCursor
ExcludeUpdateRgn
SetMessageExtraInfo
GetWindowTextLengthW
RegisterClassA
DdeQueryStringW
RegisterClassExA
SetWindowRgn
DrawTextExW
IsDialogMessageA
SystemParametersInfoA
DefWindowProcA
Sections
.text Size: 316KB - Virtual size: 316KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 320KB - Virtual size: 319KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ