Static task
static1
Behavioral task
behavioral1
Sample
1060cafa5a0f3af4c2dccb623d2dade1_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
1060cafa5a0f3af4c2dccb623d2dade1_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
1060cafa5a0f3af4c2dccb623d2dade1_JaffaCakes118
-
Size
292KB
-
MD5
1060cafa5a0f3af4c2dccb623d2dade1
-
SHA1
4cc00cc4b05a70b725889329d79930d08d51bff7
-
SHA256
19ba52ea0ca46234b49e7bb308a466a3652fb98127900b4f6ab26088fa7a9107
-
SHA512
4a8eab718f0dee8790e5114a4c1eaccb9cf217255c9fe4b112f8161ed62d49096164101516c2ae55d1fa989f953d4a19d0b864b1f6a2447ad12cb637e311ef03
-
SSDEEP
3072:kk/Qkl0bpysPy8iDmDHcCJbbsVtq4EHZIhh8VWgVDT+KW1r1FMkYojtfebQBg9cP:YpBcDmhytqdHZUgDS5Fb9fxk19BA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1060cafa5a0f3af4c2dccb623d2dade1_JaffaCakes118
Files
-
1060cafa5a0f3af4c2dccb623d2dade1_JaffaCakes118.exe windows:4 windows x86 arch:x86
35500b7019b6a3473bd523e96cc41d7c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
MultiByteToWideChar
lstrlenW
GetLastError
EnterCriticalSection
LockResource
DeleteCriticalSection
CloseHandle
LocalFree
GetFileSize
SetErrorMode
CreateProcessW
GetVolumeInformationA
Sleep
CreateProcessA
ReadFile
GetSystemDirectoryA
CreateFileW
Process32FirstW
GetModuleFileNameA
Process32NextW
CreateToolhelp32Snapshot
GetFileTime
GetVersionExA
GetWindowsDirectoryW
GetTempPathA
SetEvent
TerminateThread
GetExitCodeThread
CreateEventW
CreateThread
GetTickCount
GetModuleFileNameW
WaitForMultipleObjects
LeaveCriticalSection
FormatMessageW
SizeofResource
WideCharToMultiByte
InitializeCriticalSection
WriteFile
GetProcessHeap
WaitForSingleObject
HeapFree
GetCurrentProcess
HeapAlloc
LoadResource
FindResourceW
FindResourceExW
lstrlenA
GetTempFileNameA
HeapReAlloc
SetEndOfFile
SetEnvironmentVariableW
SetEnvironmentVariableA
CompareStringW
CompareStringA
LoadLibraryA
SetFilePointer
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
CreateFileA
GetExitCodeProcess
FlushFileBuffers
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
RaiseException
HeapDestroy
HeapSize
InterlockedIncrement
InterlockedDecrement
VirtualProtect
VirtualAlloc
GetProcAddress
GetModuleHandleA
GetSystemInfo
VirtualQuery
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
DeleteFileW
GetLocalTime
ExitProcess
GetCommandLineA
GetStartupInfoA
RtlUnwind
GetCPInfo
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
HeapCreate
VirtualFree
GetStdHandle
GetFileAttributesW
SetHandleCount
GetFileType
SetStdHandle
GetConsoleCP
GetConsoleMode
advapi32
QueryServiceStatusEx
StartServiceW
ChangeServiceConfig2W
OpenSCManagerW
CloseServiceHandle
CreateServiceW
RegisterServiceCtrlHandlerW
SetServiceStatus
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
StartServiceCtrlDispatcherW
ole32
CLSIDFromProgID
CoInitialize
CoUninitialize
CoCreateInstance
StringFromCLSID
ws2_32
WSACloseEvent
WSASetEvent
WSAStartup
getaddrinfo
WSARecv
WSASocketW
WSAGetLastError
WSAConnect
WSAEnumNetworkEvents
WSAEventSelect
WSACleanup
WSAGetOverlappedResult
freeaddrinfo
WSACreateEvent
WSASetLastError
closesocket
WSAResetEvent
WSASend
user32
UnregisterClassA
Sections
.text Size: 240KB - Virtual size: 239KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ