Static task
static1
Behavioral task
behavioral1
Sample
29aa60fbd3a6b442fe6fee32abe7adbc_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
29aa60fbd3a6b442fe6fee32abe7adbc_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
29aa60fbd3a6b442fe6fee32abe7adbc_JaffaCakes118
-
Size
469KB
-
MD5
29aa60fbd3a6b442fe6fee32abe7adbc
-
SHA1
2e3ef0ce94a802fcbf496e0565e5d116750c317d
-
SHA256
e5cca5eacfce8b4aa32d7b1e41c38b82ee5b206e7404295f667d92baddc28f63
-
SHA512
a1dba947f441b2b8d156ed49260e0e4fa22b25ece9e4fd13f76325d5c680bd174edcb3a0a3d65b5be660ea0b7f01ee0047158b3a4f89dd80594d59fc88421916
-
SSDEEP
12288:p+aU7qCovTAG1MkDUIw30COeR19sJpHzRHN17:yG1MkbwlJ19sLTRHN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 29aa60fbd3a6b442fe6fee32abe7adbc_JaffaCakes118
Files
-
29aa60fbd3a6b442fe6fee32abe7adbc_JaffaCakes118.exe windows:4 windows x86 arch:x86
816dbfe24c18a508638370701793f163
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
DeleteCriticalSection
OutputDebugStringW
InitializeCriticalSectionAndSpinCount
PulseEvent
RtlUnwind
GetModuleHandleW
GetCurrencyFormatW
GetCurrentProcess
GetEnvironmentStringsW
VirtualAlloc
IsDebuggerPresent
HeapDestroy
HeapReAlloc
GetCPInfo
GetProfileSectionA
GetACP
FindFirstFileW
InterlockedIncrement
GetModuleFileNameA
CompareStringW
GetModuleFileNameW
ExitProcess
EnumSystemLocalesA
GetLocaleInfoA
WriteFile
LoadLibraryA
GetTickCount
GetSystemTimeAsFileTime
GetFileType
FillConsoleOutputAttribute
GetStringTypeW
QueryPerformanceCounter
Sleep
LeaveCriticalSection
GetTimeZoneInformation
LCMapStringA
SetHandleCount
GetShortPathNameW
HeapAlloc
GetCurrentThread
HeapFree
TryEnterCriticalSection
VirtualFree
GetCurrentProcessId
GlobalDeleteAtom
GetOEMCP
WideCharToMultiByte
SetConsoleCtrlHandler
GetStringTypeA
GetCommandLineA
FreeEnvironmentStringsW
GetStartupInfoA
CompareStringA
TlsGetValue
MultiByteToWideChar
ConvertDefaultLocale
LocalHandle
UnhandledExceptionFilter
TlsSetValue
TlsFree
GetFullPathNameA
GetLocaleInfoW
IsValidLocale
LCMapStringW
GlobalUnlock
SetLastError
GetStdHandle
GetProcAddress
FreeLibrary
GetCommandLineW
GetProcessHeaps
HeapSize
InterlockedExchange
GetTimeFormatA
TlsAlloc
GetDateFormatA
VirtualQuery
SetUnhandledExceptionFilter
SetEnvironmentVariableA
InitializeCriticalSection
InterlockedDecrement
GetCurrentThreadId
GetUserDefaultLCID
AddAtomW
TerminateProcess
EnterCriticalSection
HeapCreate
lstrcmpA
GetModuleHandleA
IsValidCodePage
GetLastError
GetStartupInfoW
wininet
InternetUnlockRequestFile
SetUrlCacheEntryGroupA
FtpFindFirstFileW
InternetCreateUrlA
UnlockUrlCacheEntryStream
InternetTimeToSystemTimeW
InternetGetConnectedStateEx
InternetGetConnectedStateExW
GetUrlCacheEntryInfoExW
InternetTimeToSystemTime
ReadUrlCacheEntryStream
FreeUrlCacheSpaceA
GetUrlCacheEntryInfoW
InternetSecurityProtocolToStringA
InternetCombineUrlA
InternetSecurityProtocolToStringW
FindNextUrlCacheEntryExW
advapi32
InitializeSecurityDescriptor
RegConnectRegistryA
Sections
.text Size: 151KB - Virtual size: 150KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 314KB - Virtual size: 326KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ