Static task
static1
Behavioral task
behavioral1
Sample
2990962d23df8bcc1d7d02017960b8e0_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2990962d23df8bcc1d7d02017960b8e0_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
2990962d23df8bcc1d7d02017960b8e0_JaffaCakes118
-
Size
436KB
-
MD5
2990962d23df8bcc1d7d02017960b8e0
-
SHA1
ca9fa1f274b4e8aff561de81b6549004318bc090
-
SHA256
3f268d60af86522578ae7d58a109c5d41e0039f0bba006cc3a8e8d9f2bf97b6a
-
SHA512
13a8a3f54f45a103de83483429e9d95274043d3f2346df0c64ec432b6d451b93540b3c1912ac783b191e7e5db6153f319ad4ab08b2e5c88b65df6feb361c0492
-
SSDEEP
12288:pBfYxG4HSFV3BnKTCDdqs07t30JX9yu9FIQ:ffYxG4H4V3BKTC8sOSloKP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2990962d23df8bcc1d7d02017960b8e0_JaffaCakes118
Files
-
2990962d23df8bcc1d7d02017960b8e0_JaffaCakes118.exe windows:5 windows x86 arch:x86
02c7b7650830062517152e8007b39216
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
psapi
GetModuleFileNameExA
kernel32
HeapAlloc
WriteFile
CreateFileA
lstrcpyA
Process32Next
Sleep
GetExitCodeProcess
TerminateProcess
OpenProcess
lstrcmpiA
Process32First
CreateProcessA
lstrlenA
CreateDirectoryA
SleepEx
GetModuleFileNameA
SetEndOfFile
SetFilePointer
ReadFile
GetFileSize
LoadLibraryExA
GetComputerNameA
LocalFree
GetVersionExA
GetLocalTime
lstrcatA
WaitForSingleObject
MoveFileExA
GetModuleHandleA
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
GetFileTime
GetCurrentProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
HeapCreate
LCMapStringW
LCMapStringA
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
FlushFileBuffers
GetTickCount
QueryPerformanceCounter
HeapFree
GetProcessHeap
SetLastError
DeleteFileA
GetFileAttributesA
OpenMutexA
CloseHandle
InterlockedDecrement
ExpandEnvironmentStringsA
GetLastError
OpenFileMappingA
CreateFileMappingA
MapViewOfFile
lstrcpynA
WideCharToMultiByte
FreeLibrary
LoadLibraryA
IsValidCodePage
GetProcAddress
GetFullPathNameA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetOEMCP
GetACP
GetCPInfo
HeapSize
GetCurrentThreadId
InterlockedIncrement
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetStdHandle
VirtualAlloc
DeleteCriticalSection
RtlUnwind
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapReAlloc
GetModuleHandleW
ExitProcess
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
GetFileType
GetConsoleCP
GetConsoleMode
GetCommandLineA
GetStartupInfoA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
VirtualFree
user32
FindWindowA
SendMessageTimeoutA
GetClassNameA
IsWindowVisible
EnumWindows
GetWindowThreadProcessId
IsWindow
advapi32
LookupAccountNameA
ConvertSidToStringSidA
RegSetValueExA
RegDeleteKeyA
RegQueryInfoKeyA
RegEnumKeyA
RegDeleteValueA
RegCreateKeyA
RegOpenKeyExA
RegQueryValueExA
RegOpenKeyA
RegCloseKey
OpenSCManagerA
OpenServiceA
QueryServiceStatus
CloseServiceHandle
shell32
ShellExecuteA
oleaut32
VariantClear
shlwapi
StrNCatA
StrStrIA
wnsprintfA
StrChrA
StrToIntA
SHDeleteKeyA
PathFileExistsA
Sections
.text Size: 131KB - Virtual size: 131KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 31KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 18KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 254KB - Virtual size: 254KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ