Static task
static1
Behavioral task
behavioral1
Sample
0.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
2.exe
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
2.exe
Resource
win10v2004-20241007-en
General
-
Target
56f83f761f1ea9ddee99644360351bdd_JaffaCakes118
-
Size
863KB
-
MD5
56f83f761f1ea9ddee99644360351bdd
-
SHA1
fb381b6a6d3c537c616e9669cf135c986ca003ea
-
SHA256
f12a4e2c946ea5c21c74beb4af72b7aa8dfaeacb5bdf518824fe8adac39bafc3
-
SHA512
e00b8ecc15a51e16b285963360cbdc79907a1549d1bc8ff574530ead812335c8ef8a4e181ebb761591cb17c95b76bdd239cec6a5c36902ee23f1cf7a34934401
-
SSDEEP
24576:5oYPDfAY3cmwB/feXSd5gCu4avbGfSuugxYvHCe:5zbX3cmwB3e7z4ajGEgs
Malware Config
Signatures
-
Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/0 unpack001/1 unpack001/2
Files
-
56f83f761f1ea9ddee99644360351bdd_JaffaCakes118.cab
-
0.exe windows:4 windows x86 arch:x86
afb99c778134ad657c7c95d6b74d50ed
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleA
GetModuleFileNameW
VirtualFree
VirtualAlloc
LoadLibraryA
FreeEnvironmentStringsA
UnhandledExceptionFilter
RtlUnwind
HeapAlloc
HeapFree
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
HeapReAlloc
GetModuleFileNameA
TerminateProcess
GetCurrentProcess
GetStringTypeA
GetStringTypeW
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
WriteFile
GetCPInfo
GetACP
GetOEMCP
GetProcAddress
MultiByteToWideChar
LCMapStringA
LCMapStringW
user32
MessageBoxA
Sections
.text Size: 40KB - Virtual size: 37KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 632KB - Virtual size: 629KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
1.sys windows:4 windows x86 arch:x86
a7436afd3605df16a27503d2a801d1f5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ExAllocatePoolWithTag
IoCreateDevice
RtlInitUnicodeString
PsGetVersion
IofCompleteRequest
IoDeleteDevice
IoCreateSymbolicLink
RtlEqualUnicodeString
ZwSetSystemInformation
RtlUnwind
KeInitializeEvent
ExFreePool
MmMapLockedPages
IoDeleteSymbolicLink
hal
HalDisplayString
ExAcquireFastMutex
ExReleaseFastMutex
Sections
.text Size: 22KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 512B - Virtual size: 508B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
2.exe .js windows:4 windows x86 arch:x86 polyglot
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 408KB - Virtual size: 408KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 3KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
3