Static task
static1
Behavioral task
behavioral1
Sample
d5fcd73cabc2e7ce6d86d7d3ab7dd2c2_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d5fcd73cabc2e7ce6d86d7d3ab7dd2c2_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
d5fcd73cabc2e7ce6d86d7d3ab7dd2c2_JaffaCakes118
-
Size
1.7MB
-
MD5
d5fcd73cabc2e7ce6d86d7d3ab7dd2c2
-
SHA1
d8b1aa82b23d20e3164c5471e86c3e31646ee2bc
-
SHA256
694fef7d7c2f0a5fdf9110caac07b01c24be8653faed1d670e3a53679ccd4d26
-
SHA512
894446e782a21f6c9c8f6879e0fdcaac380152a7d4801449ac853de4f56c2a66fac1c4cb6f00f8a71547beae0524e15bdba846cee45a101b51ffeee308088f67
-
SSDEEP
49152:JCS45lWOPX9r3FI+QPMb1Per45dcXRMR8EVLZwj:JCzpPpF1H5er45eBKr
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d5fcd73cabc2e7ce6d86d7d3ab7dd2c2_JaffaCakes118
Files
-
d5fcd73cabc2e7ce6d86d7d3ab7dd2c2_JaffaCakes118.exe windows:4 windows x86 arch:x86
04b827e73cbbc92a73ba94bc47441e80
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegEnumKeyExA
RegQueryValueExA
RegDeleteKeyA
RegEnumKeyA
RegOpenKeyExA
RegQueryValueA
RegOpenKeyA
RegCloseKey
kernel32
AddAtomW
GetCurrentThreadId
ReleaseMutex
MultiByteToWideChar
VirtualAlloc
CreateFileW
CreateDirectoryA
CopyFileA
InterlockedIncrement
DisableThreadLibraryCalls
WaitForSingleObject
InitializeCriticalSection
DeleteCriticalSection
GlobalFree
GetSystemTimeAsFileTime
QueryPerformanceCounter
CreateFileA
GetCurrentProcessId
DeleteFileA
GetLastError
GetTickCount
GetModuleFileNameW
DeviceIoControl
VirtualFree
GetVersionExA
EnumResourceNamesA
GetVolumeInformationA
GetTempFileNameA
GetModuleFileNameA
ReadFile
GlobalUnlock
WideCharToMultiByte
CloseHandle
FindResourceA
GetSystemTime
GlobalLock
GetTempPathA
LocalFree
Sleep
GetFileAttributesA
CreateMutexA
SetFilePointer
lstrlenA
LocalAlloc
SetFileAttributesA
GetFileSize
InterlockedDecrement
FreeLibrary
setupapi
CM_Get_Child
SetupDiGetDeviceRegistryPropertyW
CMP_WaitNoPendingInstallEvents
CM_Get_DevNode_Status
lz32
LZClose
LZCopy
LZOpenFileA
Sections
.text Size: 883KB - Virtual size: 3.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 855KB - Virtual size: 854KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ