Static task
static1
Behavioral task
behavioral1
Sample
16d0c8583860b091bef42a3dd461bb3c_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
16d0c8583860b091bef42a3dd461bb3c_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
16d0c8583860b091bef42a3dd461bb3c_JaffaCakes118
-
Size
176KB
-
MD5
16d0c8583860b091bef42a3dd461bb3c
-
SHA1
c2fe6e40d8a00c77959d94f113fdd6206c4bf5dc
-
SHA256
bdd3d624be18aa8e11dd18fee5663b91d9469e42183d0d893479019520bfdd19
-
SHA512
68c60bbc91f952e58981547fd5ed224326871ca3b997382013ab9b2dc70a94da27a2a2d895f9def0da47a6edbf201578c8eb1595b6e01942deb1a81f884a609f
-
SSDEEP
3072:Et4CMoM2JTCBmw4FU252R+wTUhM1PWrfS1tRRjPllFbNo9/iJ/FfWPk:w4C1M2dCBmw4FD52R+wT4M1PUfSRRjtC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 16d0c8583860b091bef42a3dd461bb3c_JaffaCakes118
Files
-
16d0c8583860b091bef42a3dd461bb3c_JaffaCakes118.exe windows:4 windows x86 arch:x86
fea384799bef5e42230f474427f0f728
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
InterlockedExchangeAdd
GetSystemInfo
GetThreadLocale
CreateEventW
ReleaseMutex
InterlockedCompareExchange
SleepEx
lstrlenW
GetFileSizeEx
FindCloseChangeNotification
lstrlenA
GetFileAttributesW
WaitForMultipleObjectsEx
ReadFile
GetSystemTime
LoadResource
FormatMessageA
ResetEvent
GlobalUnlock
FormatMessageW
CreateFileW
WaitForSingleObjectEx
GetFileSize
LocalAlloc
CompareStringA
CreateThread
FreeEnvironmentStringsA
FreeLibrary
SetFilePointerEx
RegisterWaitForSingleObject
GetVersionExA
SetFilePointer
FindClose
SizeofResource
CreateEventA
SetEnvironmentVariableA
GetLocalTime
SetStdHandle
DeleteFileW
GetModuleFileNameW
GlobalLock
LocalFree
WaitForSingleObject
InitializeCriticalSection
CloseHandle
SetErrorMode
WriteFileEx
GetFileAttributesA
GlobalFree
HeapDestroy
SetEndOfFile
CreateFileA
SetEvent
TryEnterCriticalSection
DeleteFileA
RaiseException
ReadFileEx
InterlockedExchange
GetStartupInfoA
FlushFileBuffers
CompareStringW
GlobalAlloc
GetModuleHandleA
LockResource
VirtualAlloc
user32
ReleaseCapture
PostMessageW
GetMenuStringW
PtInRect
GetSubMenu
UnregisterClassA
SetCapture
InflateRect
CheckMenuItem
MoveWindow
DrawFocusRect
SetWindowLongW
TrackPopupMenu
GetActiveWindow
GetMenuItemCount
ClientToScreen
SetWindowPos
LoadStringA
TranslateMessage
RegisterClassA
SendMessageA
ShowWindowAsync
DestroyWindow
GetCursorPos
LoadIconW
SetWindowLongA
SetMenuItemInfoA
GetMenu
AdjustWindowRectEx
DestroyMenu
DefWindowProcA
MessageBeep
AllowSetForegroundWindow
OffsetRect
GetKeyState
CreateWindowExA
SetActiveWindow
DestroyIcon
SetMenuItemBitmaps
GetWindowWord
SetMenuItemInfoW
DefWindowProcW
LoadCursorW
GetForegroundWindow
PostMessageA
CreateWindowExW
SetWindowTextW
SetWindowTextA
GetWindowTextW
ReleaseDC
GetClientRect
advapi32
GetSidIdentifierAuthority
RegCreateKeyExA
RegOpenKeyExW
RegQueryValueExA
CheckTokenMembership
RegCloseKey
OpenThreadToken
QueryServiceStatus
GetSecurityDescriptorDacl
GetTokenInformation
RegDeleteKeyA
RegOpenKeyExA
IsValidSid
RegCreateKeyW
LookupAccountSidA
SetSecurityDescriptorDacl
AllocateAndInitializeSid
shell32
SHBindToParent
msvcrt
_onexit
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
_except_handler3
__dllonexit
Sections
.text Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 132KB - Virtual size: 231KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ