Static task
static1
Behavioral task
behavioral1
Sample
16cec02a4ccba619e1745fe9a7a9b6e0_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
16cec02a4ccba619e1745fe9a7a9b6e0_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
16cec02a4ccba619e1745fe9a7a9b6e0_JaffaCakes118
-
Size
294KB
-
MD5
16cec02a4ccba619e1745fe9a7a9b6e0
-
SHA1
9781673676f97f830e0da14a54be02580d32c984
-
SHA256
eb3215afe4c41ce2c02b46752ea9a2c475ef7deceaad5a835d80f5ef68e9488d
-
SHA512
0ca3d0ab6ad99ad446759b25456ebdcd8d4073bf6c0d9369308dc5b1ac8fdf048c3768b120afd4a97cf7cd2a596f22fa4a458cdbe915340832575b955226b4a8
-
SSDEEP
6144:KAZ2yH/4SZiDOppppppppppppppppppppppppppppppppppppppppppppppppppB:Ke2Q/iOppppppppppppppppppppppppx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 16cec02a4ccba619e1745fe9a7a9b6e0_JaffaCakes118
Files
-
16cec02a4ccba619e1745fe9a7a9b6e0_JaffaCakes118.exe windows:5 windows x86 arch:x86
7d95021263827127904dd07a5212a846
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
userenv
GetProfilesDirectoryA
kernel32
GetModuleHandleA
GetComputerNameA
InterlockedIncrement
InterlockedDecrement
GetVolumeInformationA
GetCurrentProcessId
ExpandEnvironmentStringsA
OpenProcess
GlobalAlloc
GlobalFree
LocalFree
ExitProcess
CreateMutexA
IsValidCodePage
GetOEMCP
GetACP
FlushFileBuffers
lstrcpynA
GetLastError
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
InitializeCriticalSectionAndSpinCount
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
GetConsoleMode
GetConsoleCP
HeapReAlloc
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
QueryPerformanceCounter
VirtualFree
lstrcpyA
DeleteFileA
GetTempPathA
CloseHandle
GetVersionExA
FindNextFileA
GetModuleFileNameA
LoadLibraryA
GetPrivateProfileStringA
FindClose
RemoveDirectoryA
GetProcAddress
FindFirstFileA
lstrcatA
ReadFile
GetFileAttributesA
Sleep
WriteFile
GetProcessHeap
GetTickCount
HeapFree
GetCurrentProcess
GetCPInfo
HeapAlloc
FreeLibrary
SetEndOfFile
MoveFileExA
lstrlenA
SetFilePointer
lstrcmpA
GetFileSize
CreateFileA
GetModuleHandleW
HeapCreate
DeleteCriticalSection
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStdHandle
HeapSize
RtlUnwind
RaiseException
GetStartupInfoA
GetCommandLineA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LCMapStringW
MultiByteToWideChar
WideCharToMultiByte
LCMapStringA
GetCurrentThreadId
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TerminateProcess
TlsGetValue
user32
ExitWindowsEx
SendMessageA
MessageBoxA
FindWindowA
GetShellWindow
EndPaint
DestroyWindow
GetMessageA
GetWindowRect
RegisterClassExA
PostQuitMessage
FillRect
SetForegroundWindow
LoadBitmapA
LoadIconA
SetFocus
BeginPaint
TranslateMessage
InvalidateRect
GetWindowLongA
CreateWindowExA
GetDlgItem
DefWindowProcA
GetSysColor
SetWindowPos
ShowWindow
DispatchMessageA
AdjustWindowRectEx
SystemParametersInfoA
SetWindowTextA
UpdateWindow
LoadCursorA
GetUserObjectSecurity
GetWindowThreadProcessId
gdi32
GetTextExtentPoint32A
DeleteDC
CreateFontA
SetBkMode
DeleteObject
SelectObject
CreateCompatibleDC
GetObjectA
GetStockObject
CreateSolidBrush
TextOutA
BitBlt
advapi32
RegCloseKey
IsValidSid
GetSecurityDescriptorOwner
LookupAccountSidA
GetTokenInformation
ConvertSidToStringSidA
AdjustTokenPrivileges
RegOpenKeyA
GetUserNameA
RegDeleteValueA
RegOpenKeyExA
LookupPrivilegeValueA
RegCreateKeyA
RegDeleteKeyA
RegQueryValueExA
RegSetValueExA
OpenProcessToken
shell32
ShellExecuteA
ord680
SHGetFolderPathA
ShellExecuteExA
SHFileOperationA
oleaut32
VariantClear
shlwapi
wnsprintfA
SHDeleteKeyA
StrNCatA
StrStrIA
StrStrA
PathFileExistsA
Sections
.text Size: 70KB - Virtual size: 70KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 191KB - Virtual size: 191KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ