Static task
static1
Behavioral task
behavioral1
Sample
0b73f3b5e9cd941b0375598fa4d793c4_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0b73f3b5e9cd941b0375598fa4d793c4_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
0b73f3b5e9cd941b0375598fa4d793c4_JaffaCakes118
-
Size
892KB
-
MD5
0b73f3b5e9cd941b0375598fa4d793c4
-
SHA1
2513bfdbe2df1e3d7b010e357831df33960db0c5
-
SHA256
ebf3e97e180f8d268c52106b5f49e76a6729f86d425bbff28f7f253f1f8f4126
-
SHA512
5f0352ea52f17625db4fd8995d70bad76215a8858ede526c7a9be436a39d95b6fe25c52e2aa71eef73b90621837e9faaeaa64a1e49ce90a71481f6584cf6e717
-
SSDEEP
24576:iY/XujTDENRrkL9VaAqB/H+dyu9OAN1g:x+PDE3rkL985B/HYnE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0b73f3b5e9cd941b0375598fa4d793c4_JaffaCakes118
Files
-
0b73f3b5e9cd941b0375598fa4d793c4_JaffaCakes118.exe windows:4 windows x86 arch:x86
b48149043a60c6db6a7c23594dd2a820
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCurrentThreadId
SetStdHandle
SetFilePointer
FlushFileBuffers
CloseHandle
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
LocalFree
LeaveCriticalSection
GetProcAddress
LoadLibraryA
EnterCriticalSection
FreeLibrary
InitializeCriticalSection
DeleteCriticalSection
GetLastError
DisableThreadLibraryCalls
lstrlenW
InterlockedExchange
GetSystemInfo
GetCurrentProcess
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
MultiByteToWideChar
LCMapStringA
QueryPerformanceCounter
VirtualProtect
VirtualAlloc
GetCPInfo
GetOEMCP
GetACP
Sleep
WriteFile
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
VirtualFree
HeapCreate
HeapDestroy
GetModuleFileNameA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
GetModuleHandleA
ExitProcess
GetProcessHeap
HeapAlloc
GetVersionExA
HeapFree
GetCommandLineA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetTickCount
LocalAlloc
HeapReAlloc
VirtualQuery
InterlockedCompareExchange
user32
GetFocus
gdi32
SetLayout
ole32
CoTaskMemFree
CoTaskMemAlloc
CoInitialize
CoUninitialize
msvcrt
_initterm
_amsg_exit
__setusermatherr
_adjust_fdiv
exit
__p__fmode
__set_app_type
?terminate@@YAXXZ
_controlfp
_XcptFilter
_exit
_cexit
__getmainargs
puts
__p__commode
crypt32
CertFindAttribute
wintrust
WTHelperCertCheckValidSignature
WinVerifyTrust
WintrustRemoveActionID
WintrustAddActionID
WintrustLoadFunctionPointers
WTHelperGetProvSignerFromChain
WTHelperGetProvCertFromChain
Sections
.text Size: 256KB - Virtual size: 253KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 332KB - Virtual size: 331KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 260KB - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 40KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ