Static task
static1
Behavioral task
behavioral1
Sample
7c5e94e00597451fda1561420c295b8c_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
7c5e94e00597451fda1561420c295b8c_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
7c5e94e00597451fda1561420c295b8c_JaffaCakes118
-
Size
270KB
-
MD5
7c5e94e00597451fda1561420c295b8c
-
SHA1
71dc2d67a8699f4049ed4e799e9aff9473e39454
-
SHA256
481dfabf173a417ef3f759b8689f95a2817558916f51939d2297b19bf7ab8dba
-
SHA512
4d290554a2a08772a75ec88189a778e52131a696266d86ba82399ed35279f5c838789d12f7f19b517fae2aa31fd61738975fc81c711d7060b1583cad28e578c3
-
SSDEEP
6144:He8cCyfDzpVmNFN4ZTH0YXnI3OGsiv+lUoG9w+o1RGf:+lCybdUNFN4Zrvn4qimVGf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 7c5e94e00597451fda1561420c295b8c_JaffaCakes118
Files
-
7c5e94e00597451fda1561420c295b8c_JaffaCakes118.exe windows:4 windows x86 arch:x86
8baae8dd38021c6e65825ec47ec7880e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
version
VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW
advapi32
IsValidSid
SetFileSecurityA
CheckTokenMembership
InitializeSid
CryptCreateHash
RegEnumKeyExW
GetSidSubAuthority
AdjustTokenPrivileges
CopySid
OpenProcessToken
LookupPrivilegeValueW
InitializeSecurityDescriptor
CryptDestroyHash
GetSidLengthRequired
CryptReleaseContext
RegQueryValueExW
GetTokenInformation
RegCloseKey
RegDeleteValueW
CryptHashData
SetFileSecurityW
GetLengthSid
FreeSid
CryptAcquireContextW
CryptGetHashParam
AllocateAndInitializeSid
GetFileSecurityW
RegOpenKeyExW
SetSecurityDescriptorDacl
userenv
UnloadUserProfile
dnsapi
DnsQuery_W
DnsFree
user32
CharUpperW
PeekMessageW
CharToOemA
MsgWaitForMultipleObjects
TranslateMessage
DispatchMessageW
OemToCharA
CharUpperA
OemToCharBuffA
wsprintfW
CharToOemBuffW
CharLowerA
kernel32
QueryPerformanceFrequency
GetLocalTime
RaiseException
FileTimeToSystemTime
SetCurrentDirectoryW
lstrcpyW
WriteFile
GetShortPathNameW
HeapAlloc
IsDebuggerPresent
GetFileSize
GetTempFileNameW
LeaveCriticalSection
WideCharToMultiByte
DosDateTimeToFileTime
DeleteCriticalSection
LocalFileTimeToFileTime
GetTimeZoneInformation
HeapReAlloc
LockResource
OpenMutexW
GetTempPathW
GlobalFree
ReleaseMutex
CreateDirectoryA
SystemTimeToFileTime
SetFileTime
DeleteFileW
RemoveDirectoryW
GetVolumeInformationW
MoveFileW
FindNextFileA
SetEndOfFile
GetProcessHeap
LoadLibraryExW
SetThreadPriority
FindClose
EnterCriticalSection
FreeLibrary
WaitForSingleObject
FindFirstFileA
CreateMutexW
MoveFileExW
CopyFileW
GetWindowsDirectoryW
UnhandledExceptionFilter
SetFilePointer
CreateEventW
GetFileType
FindResourceW
SetFileAttributesW
GetDiskFreeSpaceExW
GetStdHandle
HeapFree
GetFileTime
GetSystemTime
SetLastError
GetCurrentDirectoryW
GetSystemWindowsDirectoryW
CreateProcessW
FindNextFileW
CreateFileA
CreateDirectoryW
CreateFileW
FindFirstFileW
GetSystemTimeAsFileTime
SetFileAttributesA
OutputDebugStringW
lstrlenA
IsDBCSLeadByte
SetUnhandledExceptionFilter
GetFileAttributesExW
CompareFileTime
DeviceIoControl
GetThreadPriority
GetSystemDirectoryW
LocalAlloc
HeapSize
SizeofResource
FindResourceExW
GetCurrentThreadId
GetSystemDefaultLangID
CloseHandle
ReadFile
lstrlenW
LoadResource
HeapDestroy
GetModuleHandleW
VirtualAlloc
shlwapi
PathAddBackslashW
PathFileExistsW
StrToIntExW
PathIsUNCServerW
PathAppendW
PathRemoveFileSpecW
shell32
SHGetFolderPathW
SHGetSpecialFolderPathW
ws2_32
WSAStringToAddressW
WSAStartup
inet_ntoa
inet_addr
WSACleanup
ole32
CLSIDFromString
StringFromGUID2
CoCreateGuid
crypt32
CryptMemRealloc
CertCreateCertificateContext
CertCompareCertificate
CertNameToStrW
CertVerifyValidityNesting
CryptMsgOpenToDecode
CryptMemFree
CertGetIssuerCertificateFromStore
CertDuplicateCertificateContext
CryptMsgGetParam
CertOpenStore
CertFreeCertificateChain
CertCloseStore
CryptMsgClose
CryptMemAlloc
CertFreeCertificateContext
CertAddCertificateContextToStore
CryptDecodeObjectEx
CryptMsgControl
CertCompareIntegerBlob
CertGetIntendedKeyUsage
CertFindExtension
CryptMsgUpdate
iassvcs
IASUninitialize
IASSetMaxNumberOfThreads
IASSetMaxThreadIdle
IASVariantChangeType
glu32
gluPerspective
gluEndSurface
gluTessNormal
gluEndCurve
gluDisk
gluProject
Sections
.vcOQd Size: 2KB - Virtual size: 30KB
IMAGE_SCN_MEM_READ
.DrfNZec Size: 1024B - Virtual size: 37KB
IMAGE_SCN_MEM_READ
.ntRkpjA Size: 3KB - Virtual size: 38KB
IMAGE_SCN_MEM_READ
.rWliQMk Size: 1KB - Virtual size: 36KB
IMAGE_SCN_MEM_READ
.text Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.RYzaBH Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ejuobG Size: 1024B - Virtual size: 930B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.yvxfss Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.oxRZUrp Size: 1024B - Virtual size: 826B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.DXZhxhr Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 7KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 211KB - Virtual size: 210KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.Ylst Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.Mhhhjaa Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xlHIli Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ