Static task
static1
Behavioral task
behavioral1
Sample
083009f5048e625c42e73850430a938c_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
083009f5048e625c42e73850430a938c_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
083009f5048e625c42e73850430a938c_JaffaCakes118
-
Size
410KB
-
MD5
083009f5048e625c42e73850430a938c
-
SHA1
6f040a62945934abba625c9376f8aaa21664cfb1
-
SHA256
e4eabedc71a47626ccd20729ac0fde5bc1d0980a76c6d1761dec943c54618b31
-
SHA512
a017994f0b0c35673a00e83be24e182e420e84e2a8782c25bd1c4865a4ca71c82da48eccc5580927dce8f0ab1d7c8803a80296e95fc8a74f3661e443ca97fee1
-
SSDEEP
12288:r3dlrX3xCnOWwdUDBTRRWAInEqLP6YZMHPMPaP7rjQen:LdlrX3xCLw0FRRHYEqz60MHXPXjQe
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 083009f5048e625c42e73850430a938c_JaffaCakes118
Files
-
083009f5048e625c42e73850430a938c_JaffaCakes118.exe windows:4 windows x86 arch:x86
61c8dece9ec63915a133384dc6ef7d50
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FoldStringA
RtlMoveMemory
GetSystemInfo
lstrcmpiW
RtlUnwind
GetEnvironmentStringsW
ReleaseMutex
GetCurrentProcess
GetCommandLineA
VirtualAlloc
GetUserDefaultLCID
GetStringTypeA
HeapReAlloc
FreeEnvironmentStringsA
FindResourceA
EnumSystemLocalesA
EnumCalendarInfoExA
VirtualProtect
GetModuleFileNameA
LocalAlloc
GetEnvironmentStrings
UnhandledExceptionFilter
CompareStringW
GetDateFormatA
TlsGetValue
LoadLibraryA
GetTickCount
GetSystemTimeAsFileTime
GetCommandLineW
ReadFileEx
GetOEMCP
QueryPerformanceCounter
LCMapStringW
HeapSize
WideCharToMultiByte
HeapDestroy
IsValidLocale
WritePrivateProfileStringA
HeapAlloc
GetACP
HeapFree
TransmitCommChar
TlsAlloc
GetCurrentProcessId
VirtualFree
GetFileType
TlsFree
IsBadWritePtr
GetModuleFileNameW
EnumTimeFormatsW
DeleteCriticalSection
GetLastError
SetTimeZoneInformation
SetEnvironmentVariableA
InitializeCriticalSection
GetDriveTypeW
VirtualUnlock
SetLastError
SetHandleCount
MultiByteToWideChar
WritePrivateProfileStringW
SetConsoleTextAttribute
HeapCreate
TlsSetValue
WriteConsoleOutputCharacterA
lstrlenW
GetLocaleInfoW
GetProcAddress
EnterCriticalSection
FreeEnvironmentStringsW
EnumResourceNamesW
GetStringTypeW
InterlockedExchange
WriteFile
LeaveCriticalSection
GetCPInfo
VirtualQuery
LCMapStringA
IsValidCodePage
ReadConsoleOutputA
GetTimeFormatA
GetCurrentThreadId
GetStartupInfoW
GetSystemDirectoryA
TerminateProcess
CompareStringA
GetStdHandle
GetFileSize
GetModuleHandleA
GetVersionExA
GetCurrentThread
GetLocaleInfoA
GetAtomNameW
ExitProcess
GetTimeZoneInformation
GetProfileSectionA
GetStartupInfoA
user32
GetKeyboardState
GetDoubleClickTime
SendDlgItemMessageW
DragObject
TranslateMDISysAccel
SetActiveWindow
FlashWindow
IsDialogMessageA
CreateAcceleratorTableW
RemovePropW
GetDC
SetWindowsHookExA
GetMenuStringW
MapDialogRect
GetTopWindow
OpenDesktopA
GetNextDlgGroupItem
ScrollWindowEx
OpenWindowStationA
advapi32
LookupPrivilegeValueW
GetUserNameW
RegQueryInfoKeyA
LookupPrivilegeNameA
LookupPrivilegeDisplayNameW
RegSaveKeyA
Sections
.text Size: 123KB - Virtual size: 123KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 272KB - Virtual size: 283KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ