Static task
static1
Behavioral task
behavioral1
Sample
297f39973a334751bf4354818f463705_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
297f39973a334751bf4354818f463705_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
297f39973a334751bf4354818f463705_JaffaCakes118
-
Size
163KB
-
MD5
297f39973a334751bf4354818f463705
-
SHA1
d44900535fe46edb1d11a254a05fb5937a3a76bf
-
SHA256
09cb2a6739dd464db5c516a2f50750b036fb9257063c18b82c23b02e6f3dfd74
-
SHA512
dc92c1ace96e1b38ff94e20130e7fa2a4b94c225b35d510a12567837e85db00d6b1a1fca2972ad1c6d1d3cc475044d0e2966fbf4c87219a98cdf9260fe0dfc73
-
SSDEEP
3072:aIHb2zNtYTGveIpUHRLVrTmFHmiI38qL3yiokmHUJuVxGkkk9/WdBE9:aeAmWeIOlVrViIzQHUU9O49
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 297f39973a334751bf4354818f463705_JaffaCakes118
Files
-
297f39973a334751bf4354818f463705_JaffaCakes118.exe windows:4 windows x86 arch:x86
78f30117b60f5c51c2c96896ccb5a093
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
ChangeServiceConfigA
CreateServiceA
GetTokenInformation
InitializeSecurityDescriptor
QueryServiceStatus
RegCreateKeyExA
SetServiceStatus
StartServiceCtrlDispatcherA
kernel32
CopyFileA
CreateDirectoryA
CreateEventA
CreateFileA
CreateFileMappingA
CreateThread
CreateToolhelp32Snapshot
DeleteAtom
DeleteCriticalSection
DeleteFileA
EnterCriticalSection
ExitProcess
ExpandEnvironmentStringsA
FindClose
FindNextFileA
FlushFileBuffers
FreeEnvironmentStringsA
FreeLibrary
GetACP
GetCommandLineA
GetConsoleOutputCP
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDriveTypeA
GetExitCodeProcess
GetFileSize
GetFileType
GetLastError
GetLocalTime
GetLocaleInfoA
GetModuleHandleA
GetOEMCP
GetPrivateProfileSectionNamesA
GetPrivateProfileStringA
GetProcAddress
GetProcessHeap
GetStdHandle
GetStringTypeA
GetSystemTime
GetSystemTimeAsFileTime
GetTempPathA
GetTimeFormatA
GetVersionExA
GlobalFree
HeapAlloc
HeapSize
InitializeCriticalSection
InterlockedCompareExchange
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
LCMapStringA
LeaveCriticalSection
LoadResource
LocalFree
MulDiv
MultiByteToWideChar
OpenProcess
OutputDebugStringA
QueryPerformanceCounter
RaiseException
ReadFile
ReadProcessMemory
RemoveDirectoryA
ResetEvent
RtlUnwind
SearchPathA
SetCurrentDirectoryA
SetEndOfFile
SetErrorMode
SetHandleCount
SetLastError
SetPriorityClass
SetStdHandle
SizeofResource
SuspendThread
TerminateProcess
TlsFree
TlsSetValue
UnhandledExceptionFilter
VirtualFree
WriteFile
lstrcatA
lstrcmpiA
lstrcpynA
user32
CallNextHookEx
ClientToScreen
DialogBoxParamA
DispatchMessageA
DrawFocusRect
DrawTextA
EndDialog
FindWindowA
GetDlgCtrlID
GetMessageA
GetSubMenu
GetSysColor
GetWindowLongA
InvalidateRect
LoadCursorA
LoadIconA
MapWindowPoints
MessageBoxA
PeekMessageA
RegisterClassExA
RegisterWindowMessageA
ReleaseDC
SetDlgItemTextA
SetWindowLongA
SetWindowRgn
ShowWindow
UnhookWindowsHookEx
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
Sections
.text Size: 25KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.CRT Size: 114KB - Virtual size: 244KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.edata Size: 15KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ