Static task
static1
Behavioral task
behavioral1
Sample
fe958a668644004503f2875125a956b9_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fe958a668644004503f2875125a956b9_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
fe958a668644004503f2875125a956b9_JaffaCakes118
-
Size
56KB
-
MD5
fe958a668644004503f2875125a956b9
-
SHA1
8b87bd46c2048afe35bbb72b4228471e5d02aeda
-
SHA256
a205f1a2fc24e77f15ca94b85982c4a6c2010de116bcf2661faed2571c8fe0cc
-
SHA512
8c232a0928ad75ac276805f3085242e2ab3e2976c1eb2bc7067ce83afd92f40875381c97877cb01a34ba1110c697e5682e75a138866e8a99c2758f4b83a420d1
-
SSDEEP
768:wivvZwyvLvGfXcImTAzHh1EC59+wds7ofPcIvhKK3s8Tb:dRw+AzHh559DdKK3s8T
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fe958a668644004503f2875125a956b9_JaffaCakes118
Files
-
fe958a668644004503f2875125a956b9_JaffaCakes118.exe windows:4 windows x86 arch:x86
7b5df8a95861c64d5cd570759e5c92cc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
powrprof
IsPwrHibernateAllowed
IsPwrSuspendAllowed
SetSuspendState
oleaut32
VarUI4FromStr
kernel32
LocalFree
FindResourceW
HeapSize
HeapReAlloc
CloseHandle
GetCurrentThreadId
SetUnhandledExceptionFilter
SizeofResource
FormatMessageW
GetQueuedCompletionStatus
CreateIoCompletionPort
RaiseException
GetModuleHandleW
DisableThreadLibraryCalls
WaitForSingleObject
GetDriveTypeW
LoadResource
HeapAlloc
DeleteCriticalSection
GetProcessHeap
lstrcmpiW
PostQueuedCompletionStatus
LockResource
GetSystemTimeAsFileTime
WaitForMultipleObjects
GetSystemTime
HeapDestroy
FindResourceExW
CreateFileW
LeaveCriticalSection
UnhandledExceptionFilter
HeapFree
OpenProcess
LocalAlloc
IsDebuggerPresent
lstrlenW
FreeLibrary
LoadLibraryExW
EnterCriticalSection
GetTimeFormatW
VirtualAllocEx
lstrlenA
user32
GetSystemMetrics
DestroyWindow
CharNextW
GetDesktopWindow
psapi
GetProcessImageFileNameW
ole32
CoTaskMemFree
CoTaskMemRealloc
CoCreateGuid
IIDFromString
CoTaskMemAlloc
CoCreateInstance
certcli
CAUpdateCA
CAGetCAProperty
DllInstall
CAOIDDelete
GetProxyDllInfo
CACountCertTypes
CAGetCASecurity
DllRegisterServer
CAFindByCertType
CASetCertTypeProperty
CAGetCertTypeKeySpec
kbdfi
KbdLayerDescriptor
Sections
.text Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.qYoT Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdbDoC Size: 512B - Virtual size: 159B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.AodVAwb Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 2KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 317KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.eyueImb Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sBtmJLb Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ