Init
Static task
static1
Behavioral task
behavioral1
Sample
29eb2d9cc588cf86db1bbb19ebdbfbdf_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
29eb2d9cc588cf86db1bbb19ebdbfbdf_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
29eb2d9cc588cf86db1bbb19ebdbfbdf_JaffaCakes118
-
Size
203KB
-
MD5
29eb2d9cc588cf86db1bbb19ebdbfbdf
-
SHA1
bc8b35726213efc10d38b7a6c3c1c19c493fc8a4
-
SHA256
21067f787bf01926af8cbb2242f0e7fc28ded73f47d7b0e12e7a486f27b20566
-
SHA512
7ff131662362535619b7f69b663d54ea664c0226d02592bbbb693ddde20bbd9829753db170bdd38f00657268d6497047554b1b97e0c0d4f6c6767d0e6a7f664a
-
SSDEEP
3072:uypukCVpZjBOorfROGBpMHWPpodIutioAg0Fu0hYGtMLD9ZTY:uiZCVpbOor5BBRPpepAO04RZTY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 29eb2d9cc588cf86db1bbb19ebdbfbdf_JaffaCakes118
Files
-
29eb2d9cc588cf86db1bbb19ebdbfbdf_JaffaCakes118.exe windows:5 windows x86 arch:x86
66225198256c26e034fc15119b243a66
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
OutputDebugStringA
CloseHandle
CreateFileW
ReadFile
SetEndOfFile
LCMapStringW
GetModuleHandleA
WriteConsoleW
HeapReAlloc
IsProcessorFeaturePresent
HeapSize
FlushFileBuffers
SetStdHandle
GetFileSize
GetOEMCP
GetACP
GetCPInfo
GetConsoleMode
GetConsoleCP
GetSystemInfo
CreateFileMappingA
LoadLibraryA
GetProcAddress
GetLastError
GetProcessHeap
FlushViewOfFile
HeapAlloc
UnmapViewOfFile
MultiByteToWideChar
MapViewOfFile
SetFilePointer
Sleep
LoadLibraryW
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
InterlockedDecrement
IsValidCodePage
CreateFileA
GetCurrentThreadId
SetLastError
GetCommandLineA
HeapSetInformation
GetStartupInfoW
HeapFree
GetModuleHandleW
ExitProcess
DecodePointer
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
TerminateProcess
GetCurrentProcess
EnterCriticalSection
LeaveCriticalSection
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
GetStringTypeW
WriteFile
GetModuleFileNameW
HeapCreate
RtlUnwind
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
RaiseException
user32
GetForegroundWindow
DrawFrameControl
GetSystemMetrics
RegisterClassW
EndPaint
PostQuitMessage
EnumChildWindows
LoadCursorW
wsprintfA
BeginPaint
GetClassInfoExW
GetDC
LoadStringA
LoadIconW
GetWindowTextA
MessageBoxA
GetWindowTextW
DefWindowProcA
GetSysColor
GetCursorPos
gdi32
CreatePalette
DeleteObject
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
CreateBitmapIndirect
Polyline
CreatePen
TextOutA
DeleteDC
shell32
SHGetDesktopFolder
ole32
CreateObjrefMoniker
CoInitialize
version
GetFileVersionInfoW
shlwapi
PathFindFileNameA
wvnsprintfA
StrChrA
comctl32
ImageList_Add
secur32
AcquireCredentialsHandleA
Exports
Exports
Sections
.text Size: 99KB - Virtual size: 99KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 41KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 56KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ