Static task
static1
Behavioral task
behavioral1
Sample
0e7e4e86f3b70f5990a3268b0a6020be_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0e7e4e86f3b70f5990a3268b0a6020be_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
0e7e4e86f3b70f5990a3268b0a6020be_JaffaCakes118
-
Size
188KB
-
MD5
0e7e4e86f3b70f5990a3268b0a6020be
-
SHA1
2fac829bb931553b565e225e69faaf731c87fddf
-
SHA256
edebc06fe885215a1b7801ade6ad1866a42ba4f5cf1ac2fabbb38b63ad56d093
-
SHA512
293b25ecd5fa391fcd64b00e61961e34b1f6e586f35091ae5223e2d312bc1698433ff173bb7e232c1cbd7591ffa3d3cbf7c7353572c4cc5829c40f88dbe960aa
-
SSDEEP
3072:iC/XxeoCsaQS6fJm9Tt0ql2FuQRSLJOykFeZVv7cE4oZe0PERUWwAQC:B/xaQS6M9TRquQuOyj7v7cE/lMRE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0e7e4e86f3b70f5990a3268b0a6020be_JaffaCakes118
Files
-
0e7e4e86f3b70f5990a3268b0a6020be_JaffaCakes118.exe windows:4 windows x86 arch:x86
c905232e5765ce9365391a0ef26d0ebe
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
SHDeleteKeyA
sfc
SfcIsFileProtected
user32
CharNextA
wsprintfA
kernel32
InterlockedExchange
LoadLibraryA
RaiseException
GetStartupInfoA
LocalAlloc
FreeLibrary
GetLastError
CreateDirectoryA
GetFileAttributesA
lstrcpyA
lstrlenA
DeleteFileA
SetFileAttributesA
CloseHandle
Process32Next
GetCurrentProcessId
Process32First
CreateToolhelp32Snapshot
GetTickCount
lstrcatA
GetSystemDirectoryA
MultiByteToWideChar
GetWindowsDirectoryA
HeapFree
GetProcAddress
GetModuleHandleA
HeapAlloc
GetProcessHeap
ExitProcess
SetEnvironmentVariableA
GetTempPathA
MoveFileA
SetFileTime
GetFileTime
SetFilePointer
WriteFile
CreateFileA
FindNextFileA
FindFirstFileA
lstrcmpiA
GetModuleFileNameA
Sleep
WaitForSingleObject
CreateEventA
GetShortPathNameA
ExpandEnvironmentStringsA
OpenEventA
SetUnhandledExceptionFilter
GetCommandLineA
WideCharToMultiByte
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
msvcrt
_stricmp
_itoa
_strnicmp
_strlwr
_controlfp
__set_app_type
strlen
free
malloc
_except_handler3
strcpy
rand
srand
_ftol
toupper
tolower
??3@YAXPAX@Z
memcpy
??2@YAPAXI@Z
strcat
strncat
strchr
memset
strcmp
__CxxFrameHandler
_CxxThrowException
strncpy
strstr
??1type_info@@UAE@XZ
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
netapi32
NetApiBufferFree
NetUserGetLocalGroups
Sections
.text Size: 16KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 160KB - Virtual size: 162KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ