_gekelberifin@8
Static task
static1
Behavioral task
behavioral1
Sample
fb4bf7934c051b5596f1f41aa997b82e_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fb4bf7934c051b5596f1f41aa997b82e_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
fb4bf7934c051b5596f1f41aa997b82e_JaffaCakes118
-
Size
3.7MB
-
MD5
fb4bf7934c051b5596f1f41aa997b82e
-
SHA1
4dff37345300a7098593f683ac550a82db78d7f6
-
SHA256
10fe19f8d3af0d7c04511db2ec0595852dd5e09575e477c975b52e853ddc8c58
-
SHA512
3f57e575adc6bb34d845290cc1493c03ebb2d38c5ea5133feff208ddb5e41a17e4911282e68dbbbd179232f548544978f0fb40237255868843cfaf846ba86462
-
SSDEEP
98304:2ofcVB6sLaUjUWZa0nFdYjcaqIPzUFnYG1xgLg:P0iy9UWZa0vYAaqIPzuYG1xcg
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fb4bf7934c051b5596f1f41aa997b82e_JaffaCakes118
Files
-
fb4bf7934c051b5596f1f41aa997b82e_JaffaCakes118.exe windows:5 windows x86 arch:x86
5fcdfeb1c3c0323f0647fc2922ca3cc3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
EnumResourceNamesW
OpenFile
lstrlenA
WritePrivateProfileStructA
TlsGetValue
ScrollConsoleScreenBufferW
CreateJobObjectW
OpenSemaphoreA
ConnectNamedPipe
CallNamedPipeW
FreeEnvironmentStringsA
_lclose
GetProcessPriorityBoost
CreateNamedPipeW
ReadConsoleW
WriteFile
GetUserDefaultLangID
GetCommandLineA
SetCommTimeouts
FindResourceExA
GlobalAlloc
LoadLibraryW
Sleep
GetPrivateProfileStructW
GetVersionExW
DeleteVolumeMountPointW
SetConsoleMode
WriteConsoleW
GetBinaryTypeA
lstrcatA
FillConsoleOutputCharacterA
GlobalUnlock
DeactivateActCtx
InterlockedExchange
GlobalUnfix
SetCurrentDirectoryA
GetLastError
IsDBCSLeadByteEx
GetTapeStatus
SetVolumeLabelW
EnterCriticalSection
_hwrite
SetFileApisToOEM
GetLocalTime
OpenMutexA
SetCalendarInfoW
BeginUpdateResourceA
PostQueuedCompletionStatus
WriteProfileSectionW
AddAtomA
GetTapeParameters
WaitForMultipleObjects
GetModuleHandleA
LoadLibraryExA
VirtualProtect
EnumDateFormatsW
GetConsoleCursorInfo
LocalSize
lstrcpyA
SetThreadPriority
FileTimeToDosDateTime
GetStartupInfoA
SetUnhandledExceptionFilter
GetModuleHandleW
GetProcAddress
ExitProcess
GetStdHandle
GetModuleFileNameA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
VirtualAlloc
HeapReAlloc
RtlUnwind
HeapSize
GetLocaleInfoA
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
user32
GetCursorPos
gdi32
GetBitmapDimensionEx
Exports
Exports
Sections
.text Size: 3.7MB - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 3.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.hegup Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ripav Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 15KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ