Static task
static1
Behavioral task
behavioral1
Sample
30164310e955dcb5c27a369ca48ff8da_JaffaCakes118.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
30164310e955dcb5c27a369ca48ff8da_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
30164310e955dcb5c27a369ca48ff8da_JaffaCakes118
-
Size
81KB
-
MD5
30164310e955dcb5c27a369ca48ff8da
-
SHA1
6184ad2da9db48d4ec3a2079d04f8b3904b058a8
-
SHA256
1e8107520f0ae8b357d612f6a54cd74c38ff1e7bb0a1dc98781a71e535b20b9c
-
SHA512
983ecccb8cacc910d64dcda04df0656a0cfc9da24dd847f0987400e730e4447bb43a72c6688a9e8f127f28b7db2009b1886136f9411da1c714c5be5682257d6e
-
SSDEEP
1536:kZX6XL+9YTUqqov4J0DnPYdxrGFG8GBmT692MgolnqruMJJcjdg9bLB:+E+KTUqqIi0DPwWGnBv2MRlqrXJ9
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 30164310e955dcb5c27a369ca48ff8da_JaffaCakes118
Files
-
30164310e955dcb5c27a369ca48ff8da_JaffaCakes118.exe windows:5 windows x86 arch:x86
63dc08022896fd1c90fc605ec0fd8865
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
GetSecurityDescriptorGroup
ReadEncryptedFileRaw
TreeResetNamedSecurityInfoW
OpenBackupEventLogA
AccessCheckByTypeResultListAndAuditAlarmByHandleW
ElfBackupEventLogFileA
LsaLookupPrivilegeDisplayName
LsaOpenTrustedDomain
DuplicateEncryptionInfoFile
QueryServiceConfig2A
GetAuditedPermissionsFromAclW
LsaSetQuotasForAccount
CryptEncrypt
QueryServiceConfig2W
LsaSetSystemAccessAccount
EqualSid
LookupPrivilegeNameW
setupapi
pSetupFree
SetupDiSetSelectedDriverA
pSetupStringTableStringFromId
CM_Open_Class_Key_ExW
CM_Test_Range_Available
SetupSetSourceListA
CM_Get_Res_Des_Data_Ex
SetupDiGetHwProfileListExA
SetupTerminateFileLog
SetupDiInstallClassA
CM_Get_HW_Prof_FlagsA
SetupPromptForDiskW
kernel32
GetCurrentProcess
VerLanguageNameW
DeleteAtom
GetCurrentActCtx
GetConsoleFontSize
Sleep
BackupSeek
VirtualProtectEx
SetVolumeLabelA
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
IsBadHugeWritePtr
IsDBCSLeadByte
GetPrivateProfileStructW
GetSystemDefaultLangID
Module32Next
LoadLibraryA
HeapSetInformation
VirtualAlloc
msvcrt20
_mbctohira
?write@ostream@@QAEAAV1@PBCH@Z
_statusfp
_tcsncicmp
??_7istrstream@@6B@
_wspawnle
_cgets
??0ifstream@@QAE@HPADH@Z
fwprintf
__doserrno
?setrwbuf@stdiobuf@@QAEHHH@Z
??0strstream@@QAE@PADHH@Z
??_Estdiostream@@UAEPAXI@Z
_c_exit
_wcsset
?peek@istream@@QAEHXZ
Sections
.text Size: 33KB - Virtual size: 33KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 27KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 228B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ