Static task
static1
Behavioral task
behavioral1
Sample
0684cfc9102c02d85aa71c2bd5e64f5d_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
0684cfc9102c02d85aa71c2bd5e64f5d_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
0684cfc9102c02d85aa71c2bd5e64f5d_JaffaCakes118
-
Size
260KB
-
MD5
0684cfc9102c02d85aa71c2bd5e64f5d
-
SHA1
363d1dbe0aec0595fcc8cb449c7d2e9b092c38c7
-
SHA256
0e2fe849593b612815d6f6c5c1b266f00ebe4d961fbf59badcb960bf2fb0b78a
-
SHA512
813e6c8a44a4bc43ec769b49ab109b6852a9f552dc33d30b264eb136eff5f9d3cf3e6cfb0ce3ca0d11136501d9ce07eb9870bbac691c336da0507144685f5864
-
SSDEEP
6144:Wpv7N9AhTauHulI0HT2oI5iKXzxW75BPFEjem1YUy2ATdz:OUMziijPHmDy2ATd
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0684cfc9102c02d85aa71c2bd5e64f5d_JaffaCakes118
Files
-
0684cfc9102c02d85aa71c2bd5e64f5d_JaffaCakes118.exe windows:4 windows x86 arch:x86
bb8ab19a4d7472af53fd9a0de3aec355
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
StartServiceW
RegNotifyChangeKeyValue
RegCreateKeyExA
CryptSignHashW
CryptDestroyHash
LookupPrivilegeNameA
RevertToSelf
RegOpenKeyA
LookupAccountSidA
AbortSystemShutdownW
CryptSetProvParam
CryptAcquireContextW
CryptSignHashA
RegFlushKey
CryptGenRandom
RegSetValueW
CryptDuplicateKey
RegEnumValueA
RegSetValueExA
RegRestoreKeyW
LookupPrivilegeDisplayNameW
RegSaveKeyW
InitiateSystemShutdownA
gdi32
Chord
GetBitmapDimensionEx
GetDIBColorTable
GetICMProfileA
PolyBezierTo
CopyEnhMetaFileA
SetBitmapDimensionEx
GdiPlayScript
GetKerningPairs
PatBlt
user32
SetWindowWord
GetClassInfoExA
ChangeDisplaySettingsA
SetWindowsHookA
SetParent
RegisterDeviceNotificationA
GetTabbedTextExtentA
ShowCaret
DefFrameProcW
ToAsciiEx
AppendMenuW
WINNLSEnableIME
GetTopWindow
UnionRect
EnableScrollBar
OemToCharW
FlashWindow
comdlg32
GetOpenFileNameA
GetFileTitleW
ChooseFontW
PrintDlgA
FindTextA
ChooseColorW
PageSetupDlgW
ReplaceTextA
GetSaveFileNameA
ChooseColorA
LoadAlterBitmap
PageSetupDlgA
ReplaceTextW
ChooseFontA
kernel32
InterlockedExchange
GetStartupInfoA
FreeEnvironmentStringsA
LCMapStringA
GetDateFormatA
Sleep
HeapFree
GetProcAddress
ExitProcess
RtlUnwind
InitializeCriticalSectionAndSpinCount
GetCommandLineA
GetModuleFileNameA
CompareStringA
SetHandleCount
CompareStringW
TlsSetValue
HeapReAlloc
GetUserDefaultLCID
MultiByteToWideChar
GetStdHandle
UnhandledExceptionFilter
EnterCriticalSection
GetFileType
GetTickCount
SetConsoleCtrlHandler
HeapAlloc
GetCompressedFileSizeW
FreeEnvironmentStringsW
WriteFile
GetStringTypeW
EnumResourceNamesA
SetEnvironmentVariableA
SetLastError
GetACP
EnumResourceTypesW
VirtualAlloc
SetUnhandledExceptionFilter
GetLocaleInfoA
EnumSystemLocalesA
IsValidCodePage
HeapCreate
TlsAlloc
HeapSize
TlsGetValue
GetTimeZoneInformation
GetCurrentThreadId
CreateRemoteThread
GetSystemTimeAsFileTime
GetOEMCP
GetStringTypeA
LCMapStringW
WideCharToMultiByte
DeleteCriticalSection
LeaveCriticalSection
GetEnvironmentStringsW
GetCurrentThread
VirtualFree
GetLastError
IsValidLocale
GetPrivateProfileSectionA
GetCPInfo
VirtualQuery
QueryPerformanceCounter
GetModuleHandleA
HeapDestroy
GetCurrentProcess
GetTimeFormatA
LoadLibraryA
InterlockedDecrement
IsDebuggerPresent
TerminateProcess
GetModuleHandleW
InterlockedIncrement
GetThreadTimes
FreeLibrary
GetCurrentProcessId
TlsFree
GetLocaleInfoW
GetEnvironmentStrings
shell32
DragAcceptFiles
SHGetSpecialFolderLocation
SHGetSpecialFolderPathW
SheChangeDirExW
ShellExecuteW
SHFreeNameMappings
SHGetPathFromIDListW
SHGetSettings
ShellExecuteExA
FindExecutableA
SHUpdateRecycleBinIcon
SHFileOperation
ShellHookProc
SHAddToRecentDocs
ExtractIconW
SheGetDirA
SHChangeNotify
ShellExecuteExW
RealShellExecuteExW
SHGetPathFromIDListA
Sections
.text Size: 115KB - Virtual size: 114KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 138KB - Virtual size: 161KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ