Static task
static1
Behavioral task
behavioral1
Sample
459ddfeca6263c42fcf156c03113f8be_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
459ddfeca6263c42fcf156c03113f8be_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
459ddfeca6263c42fcf156c03113f8be_JaffaCakes118
-
Size
53KB
-
MD5
459ddfeca6263c42fcf156c03113f8be
-
SHA1
cb25270442b0e8f1859b4394bab4517bf4d66013
-
SHA256
97a159aedf04bfd422b075eff173581d8492cf5ec5f325e79e71f5b8f176f876
-
SHA512
e54d850d3d6dbb536d31be17d0dd725f241fb53031bc8ebf89a3e201a96b3dd092d05b7b9b7f7f5c189b0436046abc3d59d77f2ab6a8e7367aed2fb0c4ef308d
-
SSDEEP
768:hBBfZLRzOrr0iy9zlrBjGlozaU/Ckw25:LP9zOr4rXrZVwa
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 459ddfeca6263c42fcf156c03113f8be_JaffaCakes118
Files
-
459ddfeca6263c42fcf156c03113f8be_JaffaCakes118.exe windows:5 windows x86 arch:x86
900242b304a3f19cbf3f59cd97d82fa3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateMutexW
CreateThread
DebugBreak
DeleteCriticalSection
DeleteFileW
DeviceIoControl
EnterCriticalSection
EnumResourceLanguagesW
EnumUILanguagesW
ExpandEnvironmentStringsW
FileTimeToSystemTime
FindAtomW
FindClose
FindFirstFileW
FindNextFileW
FindResourceW
FlushInstructionCache
FormatMessageW
FreeLibrary
FreeResource
GetACP
GetCommandLineW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDateFormatW
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
GetDriveTypeW
GetExitCodeThread
GetFileAttributesExW
GetFileAttributesW
GetFileSize
GetFileSizeEx
GetFullPathNameW
GetLastError
GetLocaleInfoW
GetLongPathNameW
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetNumberFormatW
GetOverlappedResult
GetPrivateProfileIntW
GetPrivateProfileStringW
GetProcAddress
GetProcessHeap
GetProfileIntW
GetQueuedCompletionStatus
GetShortPathNameW
GetStartupInfoA
GetSystemTimeAsFileTime
GetTempFileNameW
GetTempPathW
GetThreadLocale
GetTickCount
GetTimeFormatW
GetUserDefaultLCID
GetUserDefaultUILanguage
GetVersion
GetVersionExW
GetVolumeInformationW
GetVolumeNameForVolumeMountPointW
GetWindowsDirectoryW
GlobalAlloc
GlobalFree
GlobalHandle
GlobalLock
GlobalReAlloc
GlobalSize
CreateIoCompletionPort
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
InitializeCriticalSection
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
IsBadReadPtr
IsBadWritePtr
LeaveCriticalSection
LoadLibraryA
LoadLibraryExW
LoadLibraryW
LoadResource
LocalAlloc
LocalFree
LockResource
MapViewOfFile
MapViewOfFileEx
MoveFileW
MulDiv
MultiByteToWideChar
OpenFileMappingA
OutputDebugStringW
PostQueuedCompletionStatus
QueryPerformanceCounter
RaiseException
ReadDirectoryChangesW
ReadFile
ReleaseMutex
RemoveDirectoryW
ResetEvent
SetEndOfFile
SetEnvironmentVariableW
SetErrorMode
SetEvent
SetFileAttributesW
SetFilePointer
SetFilePointerEx
SetLastError
SetThreadExecutionState
SetThreadPriority
SetUnhandledExceptionFilter
SizeofResource
Sleep
SleepEx
SystemTimeToTzSpecificLocalTime
TerminateProcess
TlsAlloc
TlsGetValue
UnhandledExceptionFilter
UnmapViewOfFile
VirtualFree
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WinExec
WriteFile
lstrcatW
lstrcmpW
lstrcmpiW
lstrcpyW
lstrcpynA
lstrcpynW
lstrlenA
lstrlenW
CreateFileW
CreateFileMappingW
CreateFileMappingA
CreateEventW
CreateDirectoryW
CopyFileW
CompareStringW
CompareFileTime
CloseHandle
GetOEMCP
GetStartupInfoW
CreateFileA
GlobalUnlock
VirtualAlloc
user32
LoadIconW
advapi32
RegQueryValueExW
RegOpenKeyExW
RegOpenKeyExA
RegEnumValueW
RegEnumKeyW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
RegOpenKeyA
RegSetValueExW
RegQueryValueExA
msvcrt
_XcptFilter
__CxxFrameHandler
__dllonexit
__getmainargs
__p__commode
__p__fmode
__set_app_type
__setusermatherr
_acmdln
_adjust_fdiv
_beginthreadex
_c_exit
_cexit
_controlfp
_endthreadex
_except_handler3
_exit
_ftol
_initterm
_onexit
_purecall
_snwprintf
_stricmp
_strnicmp
_vsnwprintf
_wcsicmp
_wcsnicmp
_wcsrev
_wfopen
_wfullpath
_wtoi
_wtol
calloc
ceil
ctime
exit
fclose
fgetc
fread
free
fseek
ftell
isdigit
isprint
iswctype
iswdigit
iswspace
malloc
memmove
qsort
rand
realloc
sprintf
srand
strncpy
swprintf
swscanf
time
tolower
vswprintf
wcscat
wcschr
wcscmp
wcscpy
wcslen
wcsncat
wcsncmp
wcsncpy
wcspbrk
wcsrchr
wcsstr
Sections
.data2 Size: 512B - Virtual size: 444B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data7 Size: 512B - Virtual size: 444B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data6 Size: 512B - Virtual size: 444B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data5 Size: 512B - Virtual size: 444B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data4 Size: 512B - Virtual size: 444B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data3 Size: 512B - Virtual size: 444B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text3 Size: 21KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text2 Size: 1024B - Virtual size: 1000B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 128B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 18KB - Virtual size: 953KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ