Static task
static1
Behavioral task
behavioral1
Sample
fec8e6572c8d32827b0bc2a301b86e64_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fec8e6572c8d32827b0bc2a301b86e64_JaffaCakes118.exe
Resource
win10v2004-20240910-en
General
-
Target
fec8e6572c8d32827b0bc2a301b86e64_JaffaCakes118
-
Size
127KB
-
MD5
fec8e6572c8d32827b0bc2a301b86e64
-
SHA1
4f1943862ad89f193b56ab20229d61873e21f984
-
SHA256
3f5b7c488b8fcde45552ccfa40bf5ed37bc9464473cb5fc627ce35e07073ec7c
-
SHA512
156bde7984e92b13b819aa0cfbc1e3af9ba4c31ec6c2a4db9a91f4205aa8e0bbf213b57784239d095ae28afc9a9a5b45e05988633301d5b2816f0daecf1e5ecb
-
SSDEEP
3072:MjEKHpmxXyG7TmqguKoJP7QhRm94HcXmj1mM:iJmdz7jgoJP7QhRgHm
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fec8e6572c8d32827b0bc2a301b86e64_JaffaCakes118
Files
-
fec8e6572c8d32827b0bc2a301b86e64_JaffaCakes118.exe windows:4 windows x86 arch:x86
b2dc4fd4ea06a6dcdf851e13be4dea0d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
IsBadHugeWritePtr
LocalFlags
CreateRemoteThread
GetProcAddress
GetSystemDefaultLangID
GetHandleInformation
GetVersion
GlobalAlloc
GetStdHandle
IsSystemResumeAutomatic
MoveFileA
GlobalLock
GetSystemDirectoryA
VirtualProtectEx
PulseEvent
ReadProcessMemory
ReleaseMutex
GetCurrentProcess
AllocConsole
WriteProfileStringA
GlobalHandle
VirtualFreeEx
GetACP
FindClose
GetFileSize
SetFileAttributesA
GetEnvironmentVariableA
CommConfigDialogA
GetCPInfoExA
VirtualQuery
GetUserDefaultLangID
GetPrivateProfileStringA
MulDiv
OpenMutexA
OpenProcess
GetUserDefaultLCID
WriteProfileSectionA
DosDateTimeToFileTime
GetOEMCP
GetLargestConsoleWindowSize
SignalObjectAndWait
GlobalUnWire
GetPriorityClass
GetTickCount
GetCommandLineA
SleepEx
GetThreadTimes
HeapDestroy
GetFullPathNameA
ConnectNamedPipe
WaitForSingleObject
WriteFile
GetLogicalDriveStringsA
FlushViewOfFile
ContinueDebugEvent
GetPrivateProfileSectionA
GetNamedPipeHandleStateA
GetProcessHeaps
LocalLock
CreateWaitableTimerA
MapViewOfFile
PurgeComm
DisconnectNamedPipe
GetProfileSectionA
AddAtomA
GetSystemDefaultUILanguage
CreateDirectoryExA
WaitForMultipleObjectsEx
GetProcessVersion
GetPrivateProfileSectionNamesA
CopyFileExA
InitAtomTable
GetDiskFreeSpaceExA
GetFileType
GetCPInfo
MultiByteToWideChar
GetThreadContext
ResetEvent
GetDiskFreeSpaceA
GlobalFlags
GetSystemDefaultLCID
GetConsoleCursorInfo
LoadLibraryExA
IsProcessorFeaturePresent
BeginUpdateResourceA
GetBinaryTypeA
WaitForMultipleObjects
IsBadReadPtr
CallNamedPipeA
GetCurrentProcessId
LoadResource
FindResourceExA
LocalReAlloc
VirtualProtect
VirtualAlloc
FreeLibrary
AreFileApisANSI
CreateDirectoryA
UpdateResourceA
FindCloseChangeNotification
GetProfileStringA
LocalFree
HeapReAlloc
GetUserDefaultUILanguage
DeleteFiber
CreateFileMappingA
GetExitCodeThread
CancelWaitableTimer
CreateSemaphoreA
GetMailslotInfo
GetCurrentThreadId
GetProcessTimes
WritePrivateProfileStructA
PeekNamedPipe
MoveFileExA
GlobalAddAtomA
GlobalFindAtomA
LockResource
ReadConsoleA
GlobalCompact
DefineDosDeviceA
GetConsoleOutputCP
CopyFileA
RemoveDirectoryA
EndUpdateResourceA
GlobalFix
GetModuleHandleA
FindFirstChangeNotificationA
IsBadHugeReadPtr
HeapFree
GetEnvironmentStrings
LocalHandle
CreateEventA
LocalUnlock
PeekConsoleInputA
VirtualAllocEx
GetExitCodeProcess
ReleaseSemaphore
QueryDosDeviceA
OpenFileMappingA
GetStartupInfoA
msvcrt
time
rand
__set_app_type
_controlfp
exit
strstr
Sections
.text Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 110KB - Virtual size: 110KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE