Static task
static1
Behavioral task
behavioral1
Sample
0c7a7975ace2f13af5b07344eda7e3a9_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0c7a7975ace2f13af5b07344eda7e3a9_JaffaCakes118.exe
Resource
win10v2004-20240910-en
General
-
Target
0c7a7975ace2f13af5b07344eda7e3a9_JaffaCakes118
-
Size
51KB
-
MD5
0c7a7975ace2f13af5b07344eda7e3a9
-
SHA1
06b88cb3b42924cc802bb82b22fd0b514b0ecb3d
-
SHA256
548180059e49cbc9e145dcadff54dcbf153fffdeebb9969ed196abe4c89b4a24
-
SHA512
2659a5e17cd53b4944614219ceb5a79060d295aa5f79ffa14263022ea8440029027f9eae44d62a6ce71559f46fdeb595bdbf9c7feaf4dac5ad6b90d4716af727
-
SSDEEP
1536:pqWmznyLg7ybIvJyq/AyA374XhFUxbgkGWvtXYzXomZskOybUT/F2I1vpn9pel4x:pqSml4l2wUWLh
Malware Config
Signatures
Files
-
0c7a7975ace2f13af5b07344eda7e3a9_JaffaCakes118.exe windows:4 windows x86 arch:x86
43e21019203abaf76b784fead0a159e5
Code Sign
20:0b:ff:14:80:79:93:86:4d:57:73:53:74:b4:ca:64Certificate
IssuerCN=Root AgencyNot Before19/08/2012, 15:59Not After31/12/2039, 23:59SubjectCN=safebrowsing.mozilla.org79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate
IssuerCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USNot Before01/05/2012, 00:00Not After31/12/2012, 23:59SubjectCN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before04/12/2003, 00:00Not After03/12/2013, 23:59SubjectCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
f6:d1:3a:05:51:56:f4:14:85:c5:12:45:46:7f:e6:78:bf:9f:4d:27Signer
Actual PE Digestf6:d1:3a:05:51:56:f4:14:85:c5:12:45:46:7f:e6:78:bf:9f:4d:27Digest Algorithmsha1PE Digest MatchestrueHeaders
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcAddress
GetStdHandle
LoadLibraryA
GetCurrentThreadId
DeleteFileA
VirtualProtect
CreateFileA
LocalFree
MapViewOfFile
GetComputerNameA
ReadFile
CreateMutexA
ReleaseMutex
ExitThread
CloseHandle
GetSystemDirectoryA
VirtualAlloc
LocalAlloc
VirtualFree
CreateFileMappingA
WriteFile
advapi32
GetUserNameA
user32
GetClassInfoExA
GetForegroundWindow
wsprintfA
CreateDialogParamA
winhttp
WinHttpSetStatusCallback
WinHttpOpen
WinHttpCloseHandle
Sections
.text Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ