Static task
static1
Behavioral task
behavioral1
Sample
046c31b39dfd7efa5529d967d9da0cd2_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
046c31b39dfd7efa5529d967d9da0cd2_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
046c31b39dfd7efa5529d967d9da0cd2_JaffaCakes118
-
Size
710KB
-
MD5
046c31b39dfd7efa5529d967d9da0cd2
-
SHA1
a8dcf135677807e411fe238ca3cdb161904f0615
-
SHA256
d01a5d62bb91753fb9ebc8a48b6f1a2aa77af57a53500443e70c98d551f97cbe
-
SHA512
c11c66492e6d20c589bfd41d904782c9a7c9fcd38461e5c7f053cb3d9f4eacacf386eeef1c6b914307c5ef630db5e3a3e8c4ba44bf9711549fbc388334fccc5b
-
SSDEEP
3072:Pk8kRENOocTpQ32pBHfaCIBHK5GkMeW7SX:M84ENO19Q32r5IBqGkQ7M
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 046c31b39dfd7efa5529d967d9da0cd2_JaffaCakes118
Files
-
046c31b39dfd7efa5529d967d9da0cd2_JaffaCakes118.exe windows:5 windows x86 arch:x86
9ac7f6fada94d8392df284a84c8e1547
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FindResourceW
FindVolumeClose
FlushFileBuffers
FreeLibrary
GetACP
GetBinaryTypeW
GetConsoleAliasExesLengthW
GetCurrencyFormatW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDateFormatA
GetDateFormatW
GetDriveTypeA
GetDriveTypeW
GetExitCodeThread
GetFileAttributesA
GetFileAttributesExA
GetFileAttributesExW
GetFileAttributesW
GetFileSize
GetFileType
GetFullPathNameA
GetFullPathNameW
GetLastError
GetLocalTime
GetLocaleInfoA
GetLongPathNameA
GetLongPathNameW
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleW
GetOverlappedResult
GetPrivateProfileStringA
GetPrivateProfileStringW
GetProcessHeap
GetProfileSectionW
GetShortPathNameA
GetStartupInfoA
GetStartupInfoW
GetSystemDirectoryA
GetSystemDirectoryW
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetTempFileNameA
GetTempFileNameW
GetTempPathA
GetThreadContext
GetThreadLocale
GetTickCount
GetUserDefaultLCID
GetVersion
GetVersionExA
GetVersionExW
GetVolumeInformationW
GetWindowsDirectoryA
GetWindowsDirectoryW
GlobalAddAtomA
GlobalAlloc
GlobalFree
GlobalLock
GlobalSize
GlobalUnlock
HeapAlloc
HeapFree
InitializeCriticalSection
FindResourceExW
InterlockedDecrement
InterlockedExchange
InterlockedExchangeAdd
InterlockedIncrement
IsBadWritePtr
IsValidLocale
LCMapStringA
LCMapStringW
LeaveCriticalSection
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
LoadResource
LocalAlloc
LocalFree
LockResource
MapViewOfFile
MoveFileWithProgressW
MulDiv
MultiByteToWideChar
OpenFileMappingA
ProcessIdToSessionId
QueryDosDeviceA
QueryDosDeviceW
QueryPerformanceCounter
QueryPerformanceFrequency
QueueUserWorkItem
RaiseException
ReadConsoleW
ReadFile
ReleaseMutex
RemoveDirectoryW
ScrollConsoleScreenBufferA
SetEndOfFile
SetErrorMode
SetEvent
SetFileAttributesA
SetFileAttributesW
SetFilePointer
SetInformationJobObject
SetLastError
SetLocaleInfoA
SetStdHandle
SetThreadAffinityMask
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SwitchToFiber
SystemTimeToFileTime
TerminateProcess
UnhandledExceptionFilter
UnmapViewOfFile
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteFile
WriteFileGather
WriteProfileSectionW
WriteTapemark
lstrcatA
lstrcmpiA
lstrcmpiW
lstrcpyA
lstrcpynA
lstrcpynW
lstrlenA
lstrlenW
FindResourceA
FindNextFileW
FindNextFileA
FindFirstFileW
FindFirstFileA
FindClose
FileTimeToSystemTime
FatalExit
ExitProcess
EnumSystemLanguageGroupsA
EnterCriticalSection
DeviceIoControl
DeleteFileW
DeleteFileA
DeleteCriticalSection
DebugBreak
DebugActiveProcess
CreateThread
CreateNamedPipeW
CreateNamedPipeA
CreateMutexW
CreateMutexA
CreateFileW
CreateFileMappingW
CreateFileMappingA
CreateFileA
CreateEventW
CreateEventA
CreateDirectoryW
CreateDirectoryA
CopyFileW
CopyFileExW
CopyFileA
ConvertDefaultLocale
CompareStringW
CompareStringA
CompareFileTime
CloseHandle
VirtualAllocEx
GetModuleHandleA
LoadLibraryA
InterlockedCompareExchange
GetProcAddress
user32
CharNextW
CreateDesktopA
ExitWindowsEx
InSendMessageEx
IsDlgButtonChecked
MonitorFromWindow
SendNotifyMessageA
VkKeyScanW
gdi32
GdiInitializeLanguagePack
GdiGetSpoolMessage
FONTOBJ_cGetAllGlyphHandles
EngAssociateSurface
EndFormPage
CreateDCW
CopyMetaFileA
CLIPOBJ_ppoGetPath
CreateMetaFileW
DeleteColorSpace
EndPath
DeleteEnhMetaFile
CloseMetaFile
AbortPath
CreateCompatibleDC
GdiFlush
FillPath
DeleteObject
GdiValidateHandle
DeleteMetaFile
CloseFigure
CreateHalftonePalette
AbortDoc
BeginPath
EndDoc
CreateSolidBrush
GdiGetBatchLimit
EndPage
DeleteDC
CancelDC
CloseEnhMetaFile
GetTextCharset
InvertRgn
OffsetRgn
PolyPolyline
RemoveFontResourceExA
SetTextAlign
CreatePatternBrush
GetColorSpace
GetClipRgn
advapi32
RegQueryValueExW
shell32
SHGetMalloc
SHGetFolderLocation
CommandLineToArgvW
ExtractAssociatedIconA
SHAppBarMessage
SHFileOperationA
SHFileOperationW
SHGetDiskFreeSpaceA
ShellExecuteEx
SHGetSpecialFolderPathA
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHGetFolderPathA
SHGetIconOverlayIndexW
SHGetFileInfo
shlwapi
StrStrA
msvcrt
_CIpow
_XcptFilter
__CxxFrameHandler
__dllonexit
__p__commode
__p__fmode
__set_app_type
__setusermatherr
__wgetmainargs
_adjust_fdiv
_beginthreadex
_c_exit
_cexit
_controlfp
_except_handler3
_exit
_ftol
_initterm
_onexit
_purecall
_snwprintf
_stricmp
_strnicmp
_ultow
_vsnprintf
_vsnwprintf
_wcmdln
_wcsicmp
_wcsnicmp
_wcsupr
_wtoi
_wtoi64
_wtol
abs
atoi
atol
bsearch
ceil
exit
floor
free
isdigit
isspace
iswalnum
iswascii
iswcntrl
iswdigit
iswspace
isxdigit
malloc
memcmp
memcpy
memmove
memset
qsort
rand
realloc
srand
strchr
strncpy
swprintf
swscanf
toupper
towlower
towupper
wcscat
wcschr
wcscmp
wcscpy
wcscspn
wcslen
wcsncmp
wcsncpy
wcspbrk
wcsrchr
wcsspn
wcsstr
wcstombs
wcstoul
Sections
.text Size: 147KB - Virtual size: 146KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 50KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 505KB - Virtual size: 504KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ