Static task
static1
Behavioral task
behavioral1
Sample
0f43f8a05dd93dd88db5dab8cc08b28a_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
0f43f8a05dd93dd88db5dab8cc08b28a_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
0f43f8a05dd93dd88db5dab8cc08b28a_JaffaCakes118
-
Size
196KB
-
MD5
0f43f8a05dd93dd88db5dab8cc08b28a
-
SHA1
72745e916d61d3137c205b7e29e6581413de380e
-
SHA256
e98b7ae1aba127e147a40bacd87dda6601c726cdfe3a7898b75f812bd8eacc0a
-
SHA512
02ba750474e3bda6d37058d4cfa19c8db32d5b22160863a2724de21be4b902e599d370044815f58ac4522ed86b3d9d455983873591f8df35f793f3d79e0d0789
-
SSDEEP
1536:w9O5aWVZl7c0SDMPIH7KKEz+HgCpbjDQ0+HxCLz0Dy+5xlFUKgnoI08j+3iutotm:XLH1c0w3KvCpjkRnFUKi0u+3iuuthe
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0f43f8a05dd93dd88db5dab8cc08b28a_JaffaCakes118
Files
-
0f43f8a05dd93dd88db5dab8cc08b28a_JaffaCakes118.exe windows:4 windows x86 arch:x86
39e8b2aae8c7008400d08819076e73d6
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
urlmon
URLDownloadToCacheFileA
kernel32
FreeLibrary
lstrcmpiW
LoadLibraryExW
GetModuleHandleW
GetLastError
InitializeCriticalSection
DeleteCriticalSection
InterlockedDecrement
InterlockedIncrement
Sleep
lstrcpyA
ResetEvent
WaitForSingleObject
GetTickCount
GetCurrentThreadId
CreateThread
GetLocalTime
SystemTimeToFileTime
CompareFileTime
FileTimeToSystemTime
DeleteFileA
GlobalAddAtomA
GetModuleFileNameA
GetProcessHeap
lstrcatA
CreateEventA
ExitProcess
GetCommandLineA
GlobalFindAtomA
CloseHandle
RaiseException
LeaveCriticalSection
lstrlenW
GetModuleFileNameW
EnterCriticalSection
CreateFileA
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
IsValidCodePage
IsValidLocale
HeapFree
HeapAlloc
FindResourceExW
LoadResource
LockResource
SizeofResource
FindResourceW
WideCharToMultiByte
SetEvent
MultiByteToWideChar
SetEndOfFile
CreateFileW
lstrlenA
EnumSystemLocalesA
GetUserDefaultLCID
GetLocaleInfoW
SetStdHandle
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
FlushFileBuffers
SetFilePointer
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
ReadFile
LoadLibraryA
GetOEMCP
GetCPInfo
HeapDestroy
HeapReAlloc
HeapSize
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
VirtualProtect
VirtualAlloc
GetProcAddress
GetModuleHandleA
GetSystemInfo
VirtualQuery
GetStartupInfoA
HeapCreate
VirtualFree
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
SetHandleCount
GetStdHandle
GetFileType
WriteFile
GetConsoleCP
GetConsoleMode
RtlUnwind
user32
UnregisterClassA
GetForegroundWindow
SetForegroundWindow
CharNextW
wsprintfA
FindWindowExA
PostMessageW
DispatchMessageW
GetMessageW
PostThreadMessageW
EnumChildWindows
advapi32
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegDeleteKeyW
ole32
CoTaskMemRealloc
CoTaskMemAlloc
CoInitialize
CoCreateInstance
CoTaskMemFree
oleaut32
LoadTypeLi
LoadRegTypeLi
SysStringLen
VarUI4FromStr
VariantClear
SysAllocString
SysFreeString
SysAllocStringLen
shlwapi
StrStrIA
StrCmpNA
PathRemoveExtensionA
PathFindFileNameA
UrlIsA
StrCmpIW
StrStrIW
Sections
.avx���� Size: 192KB - Virtual size: 192KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE