Static task
static1
Behavioral task
behavioral1
Sample
571d5a09c72bfd96b44b96804b472096_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
571d5a09c72bfd96b44b96804b472096_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
571d5a09c72bfd96b44b96804b472096_JaffaCakes118
-
Size
672KB
-
MD5
571d5a09c72bfd96b44b96804b472096
-
SHA1
15885d02719c79f61f55930302a2ec0533196eb5
-
SHA256
c9419e1b50dbc8042ddbcac0df89559126263ba52845ac089948e29940a66237
-
SHA512
6eccd5a11d26a251f5b2179b1ba1dd004ad5bfd7217d8cbf286858c7390be953280ee35df12e0b1dd39d67108100defde3d8b22451d70b78fb22326ad128fc72
-
SSDEEP
12288:ROYqh/uP62wzTmRrH/bRKcRPAV211JIiU72osR6F24KFdpqVSjNuOyEN3:ROYniT2RPW22iUrw6nKFzKSjdyEN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 571d5a09c72bfd96b44b96804b472096_JaffaCakes118
Files
-
571d5a09c72bfd96b44b96804b472096_JaffaCakes118.exe windows:4 windows x86 arch:x86
4f2d982e4729f8ea1287d99d29e9dc65
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
gdi32
GdiSetBatchLimit
CloseMetaFile
PlgBlt
OffsetRgn
CreateEnhMetaFileA
GdiFlush
CreateICW
GetEnhMetaFileDescriptionA
GetDeviceGammaRamp
ExcludeClipRect
GetSystemPaletteUse
PlayEnhMetaFile
GetICMProfileW
GdiPlayJournal
ModifyWorldTransform
GetRgnBox
OffsetWindowOrgEx
kernel32
RaiseException
GetStringTypeA
OutputDebugStringW
GetOEMCP
DeleteCriticalSection
FlushFileBuffers
EnumSystemLocalesA
ReadFile
HeapSize
GetConsoleOutputCP
HeapReAlloc
GetCurrentThread
GetModuleFileNameA
SetHandleCount
GetTempPathW
GlobalFix
GetLocaleInfoA
VirtualAlloc
GetUserDefaultLCID
GetStartupInfoA
GetLastError
FindResourceW
RtlUnwind
HeapCreate
LockFile
TerminateProcess
TlsGetValue
SetUnhandledExceptionFilter
OutputDebugStringA
GetDateFormatA
GetCPInfo
CreateFileA
LoadLibraryW
WriteConsoleA
VirtualQuery
SetLastError
HeapAlloc
DebugBreak
EnumResourceTypesA
GetProcAddress
GetCurrentProcessId
Sleep
GetACP
LCMapStringW
GetModuleHandleW
GlobalAddAtomW
GetTimeFormatA
FillConsoleOutputCharacterA
TlsFree
FindFirstFileExA
HeapDestroy
GetFileType
CreateMutexA
EnumResourceNamesW
HeapFree
LCMapStringA
GetCurrentProcess
GetConsoleCP
InterlockedDecrement
InterlockedIncrement
GetModuleHandleA
IsBadReadPtr
SetFilePointer
GetConsoleMode
CompareStringA
IsValidLocale
EnterCriticalSection
GetLogicalDriveStringsW
IsDebuggerPresent
CloseHandle
GetCommandLineA
GetTickCount
GetCommandLineW
UnmapViewOfFile
LoadLibraryA
GetProfileIntW
GetModuleFileNameW
GetStringTypeW
GetSystemTimeAsFileTime
MultiByteToWideChar
ExitProcess
InitializeCriticalSectionAndSpinCount
SetConsoleCtrlHandler
QueryPerformanceCounter
FreeEnvironmentStringsW
WriteConsoleW
GetEnvironmentStringsW
lstrlenA
GetStdHandle
DosDateTimeToFileTime
CreateFileMappingW
GlobalCompact
TlsAlloc
UnhandledExceptionFilter
WideCharToMultiByte
TlsSetValue
LeaveCriticalSection
GetLocaleInfoW
GetStartupInfoW
FreeLibrary
SetStdHandle
OpenMutexA
SetEnvironmentVariableA
WriteConsoleOutputCharacterW
CompareStringW
GetCurrentThreadId
GetShortPathNameW
InterlockedExchange
GetProcessHeap
WriteFile
HeapValidate
VirtualFree
FoldStringA
IsValidCodePage
GetTimeZoneInformation
comctl32
InitCommonControlsEx
advapi32
CryptGetUserKey
LookupPrivilegeValueA
CryptDeriveKey
CryptHashSessionKey
RegOpenKeyA
LogonUserA
user32
IsCharLowerW
EnumWindowStationsW
DrawIconEx
SetPropW
IsZoomed
SetClassWord
SetDebugErrorLevel
GetWindowWord
DialogBoxParamA
GetClassLongW
GetKeyboardLayout
TranslateAccelerator
DdeQueryNextServer
VkKeyScanW
TabbedTextOutA
RegisterClassA
ChildWindowFromPointEx
GetSysColorBrush
UnregisterDeviceNotification
RegisterClassExA
CreateIconIndirect
Sections
.text Size: 303KB - Virtual size: 303KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 49KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 314KB - Virtual size: 313KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ