Static task
static1
Behavioral task
behavioral1
Sample
01a116e28ad8372121039c95bcc04dba_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
01a116e28ad8372121039c95bcc04dba_JaffaCakes118
-
Size
790KB
-
MD5
01a116e28ad8372121039c95bcc04dba
-
SHA1
bf9bfa033d6ce23af02ef63d2bae82e33411e62d
-
SHA256
970621b2b68e3980259640df402d3dc66c088db1ba22a6fddb0e249063dd0d90
-
SHA512
9363b88f7f7c7c5f0a4427534b9338df128337cb32e556632106b9d05fa47b3892848c75cb8015b388490f9b39b9ec3f3818443c3d363ac60435acb3e7177599
-
SSDEEP
12288:JztOGiprouJbqrnGd/MdcrhBO1M2xZR74U7GzSJdjz:2G2r2rG9MdGe1MQEeGMl
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 01a116e28ad8372121039c95bcc04dba_JaffaCakes118
Files
-
01a116e28ad8372121039c95bcc04dba_JaffaCakes118.exe windows:5 windows x86 arch:x86
7aee349ec31ee9e928c2c22d6b7d38bd
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetFullPathNameA
ExpandEnvironmentStringsW
GetSystemDirectoryW
GetProfileIntW
VerifyVersionInfoW
SetConsoleActiveScreenBuffer
FindFirstVolumeMountPointA
DisconnectNamedPipe
OpenFileMappingW
FreeEnvironmentStringsA
GetFileSize
GetProfileSectionW
CreateWaitableTimerW
OpenWaitableTimerA
EnumCalendarInfoA
GetShortPathNameA
FindResourceExA
CreateFileMappingW
GetProcessPriorityBoost
DeleteAtom
SetConsoleDisplayMode
SetThreadPriorityBoost
GetBinaryTypeW
GetAtomNameW
SetSystemPowerState
GetTempPathA
FreeConsole
GetOEMCP
LoadResource
GetFileTime
GetVolumePathNameW
FindVolumeClose
GetFileAttributesExA
GetSystemWindowsDirectoryA
SetLocaleInfoW
SetHandleInformation
CopyFileExA
GetModuleHandleW
GetConsoleOutputCP
BindIoCompletionCallback
FormatMessageW
CreateDirectoryA
GetModuleFileNameW
GetConsoleMode
CreateNamedPipeA
DefineDosDeviceW
GetSystemWindowsDirectoryW
SetCurrentDirectoryA
AddAtomA
DefineDosDeviceA
GetProfileStringA
GetACP
GetConsoleCursorInfo
OpenThread
PeekNamedPipe
CreateMutexW
CreateMailslotW
IsDBCSLeadByteEx
WideCharToMultiByte
MapUserPhysicalPagesScatter
QueryInformationJobObject
GetLongPathNameA
Module32FirstW
GetSystemDefaultLCID
SetErrorMode
GetProfileIntA
GetDevicePowerState
GetNamedPipeInfo
FoldStringA
PrepareTape
CompareStringA
PostQueuedCompletionStatus
Module32First
GetFileAttributesExW
GetModuleHandleA
GetStringTypeA
SetTapePosition
GetPrivateProfileStructW
FlushInstructionCache
GetCurrencyFormatA
SetComputerNameExA
GetPrivateProfileStructA
SetMailslotInfo
GetEnvironmentStrings
GetLocaleInfoW
GetConsoleAliasExesLengthA
AreFileApisANSI
GetVolumeInformationA
GetLogicalDrives
ReadDirectoryChangesW
GetProfileSectionA
ProcessIdToSessionId
GetNumberOfConsoleInputEvents
GetCPInfoExA
FindNextChangeNotification
SetThreadContext
CreateDirectoryExA
GetFileAttributesW
GetConsoleAliasExesW
CreateDirectoryExW
FlushFileBuffers
AddAtomW
GetDiskFreeSpaceExA
GetPrivateProfileStringW
GetMailslotInfo
GetConsoleAliasW
Module32Next
GetPrivateProfileIntW
GetTapeStatus
GetSystemDefaultUILanguage
MoveFileWithProgressW
SetPriorityClass
LCMapStringA
DeleteTimerQueueEx
CreateTimerQueue
FindAtomW
SetThreadLocale
ContinueDebugEvent
ReadFile
FlushConsoleInputBuffer
EraseTape
GetBinaryTypeA
GetCurrentThread
SetThreadExecutionState
GetVolumeInformationW
GetDriveTypeA
SetEndOfFile
GetDateFormatA
SetUnhandledExceptionFilter
CreateToolhelp32Snapshot
GetLogicalDriveStringsA
LCMapStringW
GetPrivateProfileSectionNamesW
ReleaseMutex
OpenJobObjectW
GetWindowsDirectoryW
CreateMutexA
GetProfileStringW
GetConsoleScreenBufferInfo
DeviceIoControl
OpenFileMappingA
CopyFileA
VirtualAlloc
FindResourceA
SetInformationJobObject
SetThreadIdealProcessor
GetConsoleCP
GetAtomNameA
SetThreadPriority
GetCompressedFileSizeW
GetPrivateProfileSectionW
CreateHardLinkA
GetSystemDefaultLangID
GetDiskFreeSpaceW
SetFileAttributesA
GetThreadLocale
GetVersion
Toolhelp32ReadProcessMemory
DeleteTimerQueue
CopyFileW
GetCompressedFileSizeA
GetNamedPipeHandleStateW
SetFileAttributesW
CreateEventW
ReadProcessMemory
CreateMailslotA
GetConsoleAliasesA
OpenEventW
GetVolumeNameForVolumeMountPointA
GetHandleInformation
GetCPInfo
FreeEnvironmentStringsW
CreateTapePartition
OpenWaitableTimerW
GetEnvironmentVariableW
GetPriorityClass
SetCalendarInfoW
OpenEventA
FindResourceW
GetFileInformationByHandle
ResetEvent
ExpandEnvironmentStringsA
FindFirstFileExA
Module32NextW
EnumCalendarInfoExA
ChangeTimerQueueTimer
GetProcAddress
GetWindowsDirectoryA
FindFirstFileA
SearchPathA
OpenMutexW
SetConsoleCP
GetStringTypeExA
DeleteTimerQueueTimer
GetProcessAffinityMask
GetThreadPriority
GetNumberFormatW
FindResourceExW
CreateSemaphoreW
CreateJobObjectA
GetPrivateProfileStringA
GetProcessVersion
GetCalendarInfoW
GetProcessIoCounters
GetCPInfoExW
GetConsoleAliasExesA
OpenJobObjectA
CompareStringW
GetDateFormatW
IsSystemResumeAutomatic
GetTempPathW
AssignProcessToJobObject
GetCommandLineA
HeapSetInformation
ExitProcess
DecodePointer
WriteFile
GetStdHandle
GetModuleFileNameA
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
GetLastError
InterlockedDecrement
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
LoadLibraryW
UnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
HeapFree
Sleep
IsValidCodePage
RtlUnwind
HeapSize
HeapAlloc
HeapReAlloc
MultiByteToWideChar
GetStringTypeW
IsProcessorFeaturePresent
advapi32
CryptDestroyHash
OpenSCManagerW
RegQueryValueExA
OpenThreadToken
LookupAccountSidW
RegNotifyChangeKeyValue
GetSecurityDescriptorDacl
CloseServiceHandle
SetThreadToken
CryptCreateHash
RegSetValueExA
RegCloseKey
LsaOpenPolicy
GetSecurityDescriptorOwner
StartServiceA
SetEntriesInAclW
RegisterEventSourceW
GetTokenInformation
OpenServiceA
RegFlushKey
GetLengthSid
SetSecurityDescriptorGroup
RegCreateKeyA
CryptGetHashParam
RegDeleteKeyA
RegOpenKeyExA
OpenSCManagerA
RegSetKeySecurity
DuplicateTokenEx
CryptAcquireContextW
RegDeleteValueW
RegEnumKeyExW
InitializeAcl
RegEnumKeyW
RegDeleteValueA
LookupAccountNameW
QueryServiceStatus
MakeSelfRelativeSD
CryptAcquireContextA
RegEnumKeyExA
RegSetValueW
GetSidSubAuthorityCount
GetSecurityDescriptorLength
GetAclInformation
RegQueryValueExW
DeregisterEventSource
OpenServiceW
RegDeleteKeyW
QueryServiceConfigW
GetAce
SetSecurityDescriptorOwner
RegEnumValueW
ImpersonateLoggedOnUser
GetSecurityDescriptorGroup
CryptGenRandom
RegCreateKeyW
CryptDestroyKey
GetSidSubAuthority
CreateWellKnownSid
AllocateAndInitializeSid
FreeSid
Sections
.text Size: 549KB - Virtual size: 549KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 49KB - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 176KB - Virtual size: 564KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ