Static task
static1
Behavioral task
behavioral1
Sample
fcc08d29d5f11e42bdb82ed564a0ed1b_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fcc08d29d5f11e42bdb82ed564a0ed1b_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
fcc08d29d5f11e42bdb82ed564a0ed1b_JaffaCakes118
-
Size
48KB
-
MD5
fcc08d29d5f11e42bdb82ed564a0ed1b
-
SHA1
f96de87b34810aad8baa1b7253ce871684cec477
-
SHA256
fa4efa53e1a290e74e03f2e0da0cda106b76b65f6a22f70941e42e197474d93a
-
SHA512
3f2db93bba59427197729da3a6bd9d29c6d5cda0e378055cd4d3aa7fab2fe812bbbbbb8093c28aa27e2bc64c65f02ec348c2593c143a96d1f918348664be97c0
-
SSDEEP
1536:NGFBtLr8tlIx+dIiyyifTQAO/sCF24qAAfmu1kC:NAJgtlIAdIiyyifsAO/jF2Gu1kC
Malware Config
Signatures
Files
-
fcc08d29d5f11e42bdb82ed564a0ed1b_JaffaCakes118.exe windows:4 windows x86 arch:x86
9e49a0e7a29388b50a09fdbba3024679
Code Sign
c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate
IssuerCN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft CorporationNot Before10/01/1997, 07:00Not After31/12/2020, 07:00SubjectCN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporationc1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate
IssuerCN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft CorporationNot Before10/01/1997, 07:00Not After31/12/2020, 07:00SubjectCN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation61:47:52:ba:00:00:00:00:00:04Certificate
IssuerCN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before16/09/2006, 01:53Not After16/09/2011, 02:03SubjectCN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
61:47:52:ba:00:00:00:00:00:04Certificate
IssuerCN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before16/09/2006, 01:53Not After16/09/2011, 02:03SubjectCN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2Certificate
IssuerCN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft CorporationNot Before16/09/2006, 01:04Not After15/09/2019, 07:00SubjectCN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
61:02:30:7e:00:00:00:00:00:06Certificate
IssuerCN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before10/03/2008, 21:57Not After10/06/2009, 22:07SubjectCN=Microsoft Windows Component Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
6a:0b:99:4f:c0:00:1b:ab:11:da:3a:a1:b6:df:ec:88Certificate
IssuerCN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft CorporationNot Before11/10/2005, 21:55Not After26/04/2010, 07:00SubjectCN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign
bb:f0:8d:1e:b5:82:7a:6d:27:bd:3d:d8:bc:f7:83:cc:60:92:a2:40Signer
Actual PE Digestbb:f0:8d:1e:b5:82:7a:6d:27:bd:3d:d8:bc:f7:83:cc:60:92:a2:40Digest Algorithmsha1PE Digest MatchesfalseHeaders
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
WriteFile
CreateFileA
GetProcAddress
LoadLibraryA
GetWindowsDirectoryA
ReadFile
GetFileSize
GetModuleFileNameA
GetModuleHandleA
GetProcessHeap
HeapAlloc
GetCommandLineA
HeapFree
user32
wsprintfA
shell32
ShellExecuteA
Sections
.data Size: 38KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE