Static task
static1
Behavioral task
behavioral1
Sample
faec8a1aa89f88f70d6069eea8bfa3d8_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
faec8a1aa89f88f70d6069eea8bfa3d8_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
faec8a1aa89f88f70d6069eea8bfa3d8_JaffaCakes118
-
Size
200KB
-
MD5
faec8a1aa89f88f70d6069eea8bfa3d8
-
SHA1
68ea9c6c5cfd35531ac887bad2e98b8d3e59904a
-
SHA256
9b3ab48804312d2ee81f8e061461b06cd584bc7d2788623b5eee31be44707533
-
SHA512
01e1193e7cadfa98d621c696278cea4e88dad73b848689e5e68bbaab48876aea7561691a90b7a0bfbf76e78a138db838c2159c8cbdb5e0bf62dd7eb260434584
-
SSDEEP
6144:+ZklpKiteAbSTmSZ5tG389Y79IBM/Kr7c:N7tjSL79I9ImyrY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource faec8a1aa89f88f70d6069eea8bfa3d8_JaffaCakes118
Files
-
faec8a1aa89f88f70d6069eea8bfa3d8_JaffaCakes118.exe windows:4 windows x86 arch:x86
45d92fe7fdc4d2205f19d65d5999c57e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_DEBUG_STRIPPED
Imports
shell32
SHGetSpecialFolderPathW
SHGetSpecialFolderPathA
setupapi
CMP_WaitNoPendingInstallEvents
SetupDiGetDeviceRegistryPropertyW
CM_Get_DevNode_Status
winmm
timeGetTime
timeSetEvent
iphlpapi
GetBestInterface
GetAdaptersInfo
SendARP
gdi32
CreateDIBitmap
wininet
InternetReadFile
InternetCloseHandle
InternetOpenUrlA
InternetOpenA
ole32
CoTaskMemFree
BindMoniker
GetRunningObjectTable
CreateItemMoniker
CoUninitialize
CoTaskMemAlloc
StgOpenStorage
CoCreateInstance
CreateBindCtx
StgIsStorageFile
StringFromGUID2
StgCreateDocfile
CoInitialize
advapi32
CryptCreateHash
RegOpenKeyExA
RegDeleteValueA
GetUserNameA
RegCreateKeyExA
CryptEncrypt
CryptHashData
CryptDestroyKey
RegEnumKeyExA
CryptReleaseContext
CryptGetHashParam
CryptImportKey
RegQueryValueExA
CryptDestroyHash
RegSetValueExA
RegEnumValueA
RegCloseKey
kernel32
CompareStringA
FreeLibrary
LoadLibraryExA
InterlockedDecrement
CreateMutexA
WaitForSingleObject
CreateFiberEx
FlushInstructionCache
VirtualAlloc
DeviceIoControl
Sleep
GetLocaleInfoA
GetLastError
DeleteCriticalSection
GetWindowsDirectoryA
GetVersionExA
GetDevicePowerState
InterlockedExchange
LocalFree
GetModuleFileNameA
CreateDirectoryA
GetThreadPriority
InterlockedIncrement
IsBadWritePtr
CreateSemaphoreA
GetACP
GetSystemDirectoryA
QueryDosDeviceA
OutputDebugStringA
DefineDosDeviceA
GetTickCount
DeleteFileA
IsBadReadPtr
LeaveCriticalSection
GlobalMemoryStatus
WriteFile
GetFileAttributesA
InitializeCriticalSection
CreateThread
EnumResourceNamesW
GetSystemTime
VirtualQuery
CloseHandle
QueryPerformanceCounter
GetModuleHandleA
WaitForMultipleObjects
FlushFileBuffers
LocalAlloc
GetCurrentProcessId
ResetEvent
ReadFile
GetLocalTime
CreateProcessA
GetSystemInfo
CreateEventA
LoadLibraryA
SetEvent
SetThreadPriority
GetCurrentThreadId
SetLastError
GetTempPathA
lstrlenA
GetComputerNameA
GetPrivateProfileStringA
CreateFileA
GetCurrentThread
GetDiskFreeSpaceA
VirtualFree
_llseek
EnterCriticalSection
GetVersion
ReleaseMutex
user32
GetQueueStatus
wsprintfA
MsgWaitForMultipleObjects
GetDesktopWindow
PostThreadMessageA
DispatchMessageA
RegisterWindowMessageA
ReleaseDC
DestroyWindow
CreateDialogParamA
ShowWindow
PeekMessageA
RealGetWindowClassA
GetDC
wvsprintfA
Sections
.text Size: 169KB - Virtual size: 168KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 26KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 228KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ