Static task
static1
Behavioral task
behavioral1
Sample
0ce3e1dfac1b81ed108052cf8d065d62_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0ce3e1dfac1b81ed108052cf8d065d62_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
0ce3e1dfac1b81ed108052cf8d065d62_JaffaCakes118
-
Size
243KB
-
MD5
0ce3e1dfac1b81ed108052cf8d065d62
-
SHA1
adf29fd5d9421cbcb921cedc58a8a13b3788ac26
-
SHA256
65e3bb491d88ee99fdd950ee33b0a9a3f59c51f04d4c48e1d8607545dda2ab1a
-
SHA512
6ce76402aaec04ef022fd80d945dbac708083452888ce6b14dc037e697758a00f54b50a046a476b928bf58dc390030ea48feaa97a691669f9e42f878c03ec54b
-
SSDEEP
6144:lin+DskApPicO5MJmjLED/cyhZ4eU82wn:lin+Dtw6cOemehHU82O
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0ce3e1dfac1b81ed108052cf8d065d62_JaffaCakes118
Files
-
0ce3e1dfac1b81ed108052cf8d065d62_JaffaCakes118.exe windows:5 windows x86 arch:x86
096b085d1d9d59c40b0baef8d1e94bfc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
CloseServiceHandle
StartServiceW
ControlService
QueryServiceStatus
OpenServiceW
CreateServiceW
OpenSCManagerW
DeleteService
SetServiceStatus
RegisterServiceCtrlHandlerW
StartServiceCtrlDispatcherW
CreateProcessAsUserW
AdjustTokenPrivileges
SetTokenInformation
DuplicateTokenEx
LookupPrivilegeValueW
OpenProcessToken
kernel32
GetLocalTime
lstrcpyW
SetFileAttributesW
DeleteFileW
CloseHandle
WaitForSingleObject
CreateProcessW
lstrcatW
GetSystemDirectoryW
CopyFileW
GetProcAddress
LoadLibraryW
GetModuleFileNameW
lstrlenA
WriteFile
ReadFile
GetFileSize
CreateFileW
GetTempFileNameW
GetTempPathW
lstrcmpiW
lstrlenW
GetComputerNameW
MultiByteToWideChar
GetACP
GetDriveTypeW
Sleep
RemoveDirectoryW
GetFileAttributesW
FindClose
FindNextFileW
FindFirstFileW
FileTimeToSystemTime
FileTimeToLocalFileTime
FreeLibrary
LockResource
LoadResource
FindResourceW
EndUpdateResourceW
UpdateResourceW
SizeofResource
GetLastError
BeginUpdateResourceW
SystemTimeToFileTime
GetFileTime
lstrcpynW
GetWindowsDirectoryW
CreateDirectoryW
DeviceIoControl
GetDiskFreeSpaceW
GetModuleHandleW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
OpenProcess
WideCharToMultiByte
GetVersionExW
lstrcmpW
TerminateThread
SetEvent
FindNextChangeNotification
FindCloseChangeNotification
WaitForMultipleObjects
FindFirstChangeNotificationW
GetCommandLineW
GetCurrentThreadId
CreateThread
CreateEventW
GetStartupInfoW
GetVersionExA
GetTimeFormatA
GetDateFormatA
HeapFree
HeapAlloc
ExitProcess
GetModuleHandleA
GetStdHandle
GetModuleFileNameA
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
SetHandleCount
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
GetTimeZoneInformation
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapReAlloc
SetFilePointer
LoadLibraryA
SetStdHandle
FlushFileBuffers
RtlUnwind
SetEndOfFile
GetProcessHeap
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
CompareStringA
GetCPInfo
CompareStringW
GetOEMCP
SetEnvironmentVariableA
GetLocaleInfoA
user32
ShowWindow
CreateWindowExW
DispatchMessageW
TranslateMessage
GetMessageW
GetForegroundWindow
PostThreadMessageW
GetInputState
RegisterClassExW
LoadCursorW
SendMessageW
FindWindowExW
GetClassNameW
PostQuitMessage
LookupIconIdFromDirectoryEx
DefWindowProcW
GetSystemMetrics
shlwapi
PathFileExistsW
shell32
ShellExecuteW
SHGetFolderPathW
SHFileOperationW
CommandLineToArgvW
Sections
.text Size: 69KB - Virtual size: 69KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 120KB - Virtual size: 119KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ