Static task
static1
Behavioral task
behavioral1
Sample
496f1defa92daf684818e5d161c71e8b_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
496f1defa92daf684818e5d161c71e8b_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
496f1defa92daf684818e5d161c71e8b_JaffaCakes118
-
Size
658KB
-
MD5
496f1defa92daf684818e5d161c71e8b
-
SHA1
de21e1d8c5645f4550f09d11295b81293164a0f1
-
SHA256
745115e5515092ad108ad14211fc1f03e0dd4730bfeb79b5fadd753a4ba14f36
-
SHA512
805a88a93ddd3b4dc9bafaebf91723a7db70302007b8603a33c6cdea4f769ca15f62c84a689fef131be73fe15984491bc434e6a8a1d51839a441bf9a933a50fc
-
SSDEEP
12288:qa11Gr3+pfNixGTdIkIxJIEo3gMH70mVogKp4tQ3BfS6oN+qESVBx7neivjX/I:qWixGpuIEow7WG4tQxa6ojxvnei7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 496f1defa92daf684818e5d161c71e8b_JaffaCakes118
Files
-
496f1defa92daf684818e5d161c71e8b_JaffaCakes118.exe windows:4 windows x86 arch:x86
68028b03509683a6993b2a9d3fd70d76
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleFileNameW
DeleteCriticalSection
MulDiv
FreeLibrary
SizeofResource
VirtualLock
LockResource
lstrcmpW
WaitForMultipleObjects
FlushInstructionCache
HeapSize
GetVersionExW
FormatMessageW
GetProcAddress
GetThreadLocale
GetSystemInfo
GlobalFree
OpenProcess
HeapFree
VirtualAlloc
IsDebuggerPresent
InterlockedExchange
QueryPerformanceCounter
GetCurrentThreadId
CreateThread
MultiByteToWideChar
TerminateProcess
LocalAlloc
GetSystemTimeAsFileTime
LoadLibraryA
RaiseException
GetLocaleInfoA
GlobalLock
GetTempPathW
UnhandledExceptionFilter
InterlockedIncrement
LocalFree
GetComputerNameW
GetTickCount
LoadLibraryW
VirtualFree
WaitForSingleObject
CreateEventW
GlobalHandle
HeapReAlloc
lstrlenW
HeapDestroy
CloseHandle
InterlockedCompareExchange
GetLocaleInfoW
HeapAlloc
SetEvent
EnterCriticalSection
CreateMutexW
InitializeCriticalSection
GlobalAlloc
LoadLibraryExW
GetACP
LoadResource
ReleaseMutex
GetVersionExA
HeapSetInformation
InterlockedDecrement
SetLastError
GetProcessId
Sleep
LCMapStringW
lstrlenA
GetCurrentProcess
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
WideCharToMultiByte
GetLastError
ProcessIdToSessionId
FindResourceW
GetSystemDirectoryW
FindResourceExW
VirtualUnlock
LeaveCriticalSection
GlobalUnlock
GetStartupInfoW
ResetEvent
CreateFileW
GetModuleHandleW
ddraw
DirectDrawCreate
DirectDrawCreateEx
wtsapi32
WTSQuerySessionInformationW
WTSFreeMemory
WTSEnumerateSessionsW
WTSUnRegisterSessionNotification
WTSRegisterSessionNotification
ole32
CoGetClassObject
OleUninitialize
OleInitialize
CoInitializeEx
CLSIDFromString
CoTaskMemFree
CoUninitialize
StringFromCLSID
CLSIDFromProgID
CoTaskMemAlloc
StringFromGUID2
CoInitializeSecurity
CoAllowSetForegroundWindow
CreateStreamOnHGlobal
CoCreateInstance
OleLockRunning
CoSetProxyBlanket
CoCreateGuid
version
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
gdiplus
GdipDisposeImage
GdiplusStartup
GdipCloneImage
GdiplusShutdown
GdipCreateHBITMAPFromBitmap
GdipFree
GdipCreateBitmapFromFile
GdipAlloc
GdipCreateBitmapFromFileICM
msvcrt
_initterm
_initterm
_wtoi64
_wcmdln
_exit
fabs
memcpy
_amsg_exit
_cexit
_controlfp
__p__commode
__wgetmainargs
?terminate@@YAXXZ
memset
__setusermatherr
__set_app_type
iswdigit
exit
__p__fmode
_XcptFilter
gdi32
BitBlt
CreateCompatibleBitmap
GetDeviceCaps
CreateCompatibleDC
GetStockObject
CreateSolidBrush
DeleteObject
DeleteDC
SelectObject
GetObjectW
shlwapi
PathCombineW
UrlCombineW
UrlApplySchemeW
UrlCanonicalizeW
UrlGetPartW
PathAppendW
crypt32
CryptUnprotectData
CryptProtectData
shell32
SHAppBarMessage
SHGetFolderPathW
FindExecutableW
ShellExecuteW
CommandLineToArgvW
Shell_NotifyIconW
ShellExecuteExW
secur32
GetUserNameExW
Sections
.text Size: 358KB - Virtual size: 357KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 278KB - Virtual size: 278KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ