Static task
static1
Behavioral task
behavioral1
Sample
2f9749861ef11028077d90c37264d965_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2f9749861ef11028077d90c37264d965_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
2f9749861ef11028077d90c37264d965_JaffaCakes118
-
Size
1.2MB
-
MD5
2f9749861ef11028077d90c37264d965
-
SHA1
092db5bd92b532fb8be8e19277205d89e2d5c42c
-
SHA256
d707309c160c2b830a2696e0a2000dc43870938028c1731304cb29b9d4c48306
-
SHA512
611a7c3302f9b1c95843c4f23ecc3c7f82a373d1ccc4fe3d06e3df0453858dffe484abb905950f6c17d8ffcf00b2e94d00ca71d92d1076a712cefc4d6cf8c2e1
-
SSDEEP
24576:1eDi74MTHhBj2ruNGAt2NqfvKbE+2iBDOMFrnLh6CYjPy:1JPXj2rvAt2qfvKf2iRPFmy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2f9749861ef11028077d90c37264d965_JaffaCakes118
Files
-
2f9749861ef11028077d90c37264d965_JaffaCakes118.exe windows:5 windows x86 arch:x86
ca8319810f97441aa6c0d1c6d493db95
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
psapi
GetModuleFileNameExW
GetModuleBaseNameW
oleaut32
SysAllocStringLen
SysReAllocStringLen
SafeArrayGetElement
SafeArrayCreate
SafeArrayGetUBound
SafeArrayGetLBound
SysStringLen
SafeArrayPtrOfIndex
VarBstrFromDate
CreateErrorInfo
GetErrorInfo
RegisterTypeLi
LoadTypeLi
VarNeg
VarBstrFromBool
VariantClear
VarBstrFromCy
VarDateFromStr
VarI4FromStr
VariantChangeTypeEx
VariantCopyInd
SafeArrayAccessData
kernel32
FlushFileBuffers
LCMapStringW
HeapSize
HeapReAlloc
HeapAlloc
OutputDebugStringW
RtlUnwind
LoadLibraryExW
IsProcessorFeaturePresent
IsDebuggerPresent
GetOEMCP
GetConsoleCP
VirtualAlloc
GetCurrentThreadId
GetLastError
InitializeCriticalSection
EnterCriticalSection
CloseHandle
MulDiv
GetSystemInfo
lstrcmpW
CreateMutexW
FindResourceExW
GetSystemDirectoryW
QueryPerformanceCounter
IsValidCodePage
GetCPInfo
WideCharToMultiByte
GetStringTypeW
GetACP
HeapFree
GetConsoleMode
SetStdHandle
SetFilePointerEx
WriteConsoleW
GetProcAddress
SetLastError
LeaveCriticalSection
GetModuleHandleW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetCommandLineW
CreateFileW
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameW
WriteFile
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
mpr
WNetGetResourceInformationW
comdlg32
ChooseFontW
FindTextW
ChooseColorW
GetSaveFileNameW
PrintDlgExW
wintrust
WinVerifyTrust
WTHelperGetProvSignerFromChain
WTHelperGetProvCertFromChain
CryptCATAdminAcquireContext
CryptCATAdminCalcHashFromFileHandle
ole32
CreateStreamOnHGlobal
CoTaskMemFree
Sections
.text Size: 88KB - Virtual size: 87KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 753KB - Virtual size: 7.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: 1024B - Virtual size: 724B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 375KB - Virtual size: 375KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ