_gifgeek@8
Static task
static1
Behavioral task
behavioral1
Sample
fb5106b00132654be98257e2ba38a950_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fb5106b00132654be98257e2ba38a950_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
fb5106b00132654be98257e2ba38a950_JaffaCakes118
-
Size
3.9MB
-
MD5
fb5106b00132654be98257e2ba38a950
-
SHA1
f462763f1c9881eb97c085382ffd4674d304c8d2
-
SHA256
1105c6506d94d440e44ce637e0e7d87c7aed386cf99d870f9bea04e3655614bf
-
SHA512
81038ec7ba4c9c4661625c16ceb3ce425b2afea09c47f7c1d46050be8c94022f5e81af6b9b5accf483d7ab1f2fa60e6eeae8883cac945fde68ff5ecab7069863
-
SSDEEP
98304:qn2AgGqDAuPt7Z0HDNhFfhis2pB2aD7cMIQNHDOgm91kYPC7/gQ:kkpUY7+QNjVYkx7/gQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fb5106b00132654be98257e2ba38a950_JaffaCakes118
Files
-
fb5106b00132654be98257e2ba38a950_JaffaCakes118.exe windows:5 windows x86 arch:x86
18bddebf83f101e73fe13655c070acaa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LocalLock
GlobalUnfix
GetPrivateProfileSectionNamesW
SleepEx
SetDefaultCommConfigA
SetStdHandle
InterlockedDecrement
SetSystemTimeAdjustment
CompareFileTime
FileTimeToDosDateTime
Sleep
CallNamedPipeW
SizeofResource
SetPriorityClass
_lcreat
FreeLibraryAndExitThread
LoadLibraryA
BuildCommDCBAndTimeoutsW
GetProcAddress
lstrcpyA
LocalAlloc
ExitThread
SetFilePointerEx
CopyFileW
SetEnvironmentVariableA
GetCurrentDirectoryW
GetTapeParameters
GetCommState
GetACP
SetUnhandledExceptionFilter
FindAtomA
WaitForMultipleObjects
CreateSemaphoreW
SetFileApisToANSI
FreeEnvironmentStringsW
EnumResourceNamesW
GetPrivateProfileStructW
ConnectNamedPipe
SetLocalTime
SetLastError
SearchPathW
GetFileAttributesW
LoadLibraryW
lstrlenA
IsBadWritePtr
InterlockedIncrement
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
RaiseException
RtlUnwind
GetCommandLineA
GetStartupInfoA
HeapValidate
IsBadReadPtr
UnhandledExceptionFilter
GetModuleFileNameW
TerminateProcess
GetCurrentProcess
IsDebuggerPresent
GetModuleHandleA
TlsGetValue
GetModuleHandleW
TlsAlloc
TlsSetValue
GetCurrentThreadId
TlsFree
GetLastError
SetHandleCount
GetStdHandle
GetFileType
ExitProcess
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
HeapFree
VirtualFree
WriteFile
HeapAlloc
HeapSize
HeapReAlloc
VirtualAlloc
GetOEMCP
GetCPInfo
IsValidCodePage
FlushFileBuffers
GetConsoleCP
GetConsoleMode
DebugBreak
OutputDebugStringA
WriteConsoleW
OutputDebugStringW
InitializeCriticalSectionAndSpinCount
CloseHandle
CreateFileA
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
SetFilePointer
SetEndOfFile
GetProcessHeap
ReadFile
Exports
Exports
Sections
.text Size: 147KB - Virtual size: 147KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3.7MB - Virtual size: 3.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 43.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ