Static task
static1
Behavioral task
behavioral1
Sample
181c9eec6ca46032e20885d4f1e5386a_JaffaCakes118.exe
Resource
win7-20240220-en
General
-
Target
181c9eec6ca46032e20885d4f1e5386a_JaffaCakes118
-
Size
64KB
-
MD5
181c9eec6ca46032e20885d4f1e5386a
-
SHA1
04912da6967ce489b1850363c15250e92a1e6b49
-
SHA256
338664f03d039b89baaf63cadb1f50fc6f0bc1531a68bf25aa6f69f274f5f67f
-
SHA512
ae7c2c94485ff0c090bb622a120aa0198f9700d3136ab29ce979bc0a505af08c0f05bbf3c245f183d52d29044abd87d1d67168a477980a7ea4d95478aa1e609a
-
SSDEEP
768:TxPY4FJJZYEF8888A+ADhfE2FMCFLvaSy9kQYq+oQMXiLeYUwKrPrOzJNsT:NVNVK+AdfE2FMCtvalbYq+oOUDrrOzj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 181c9eec6ca46032e20885d4f1e5386a_JaffaCakes118
Files
-
181c9eec6ca46032e20885d4f1e5386a_JaffaCakes118.exe windows:4 windows x86 arch:x86
8128e4c3e398ab4c4083211b37c9157e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
GetLengthSid
OpenProcessToken
CryptGenRandom
AllocateAndInitializeSid
InitiateSystemShutdownA
InitializeSecurityDescriptor
InitializeAcl
SetSecurityDescriptorDacl
AddAccessAllowedAce
CryptAcquireContextA
CryptReleaseContext
GetTokenInformation
msvcrt
strchr
sprintf
kernel32
GetUserDefaultUILanguage
GetProcessHeap
GetDriveTypeA
GetSystemTimeAsFileTime
CreateThread
RemoveDirectoryA
CreateProcessA
ExpandEnvironmentStringsA
CreateEventA
GetModuleFileNameA
GetSystemTime
GetCurrentThreadId
FreeLibrary
SetEvent
LeaveCriticalSection
GetCurrentProcessId
HeapFree
DeleteCriticalSection
GetThreadPriority
MoveFileExA
WriteFile
GetFileAttributesA
GetCommandLineA
GetDiskFreeSpaceA
ExitProcess
LocalFileTimeToFileTime
SetErrorMode
CopyFileA
SetFileAttributesA
GetProcAddress
SetFileTime
CreateEventW
CreateDirectoryA
QueryDosDeviceA
CloseHandle
OpenEventA
QueryPerformanceCounter
DosDateTimeToFileTime
WaitForMultipleObjects
SystemTimeToFileTime
GetExitCodeProcess
GetFileSize
SetEndOfFile
GetSystemDirectoryA
DeviceIoControl
CreateFileA
SetFilePointer
DeleteFileA
TerminateProcess
FindNextFileA
SetUnhandledExceptionFilter
SleepEx
LoadLibraryA
GetModuleHandleA
GetVersionExA
WaitForSingleObject
EnterCriticalSection
GetTickCount
GetCurrentDirectoryA
HeapAlloc
GetCurrentProcess
SetLastError
ReadFile
FindClose
Sleep
FindFirstFileA
MoveFileA
WideCharToMultiByte
user32
ShowWindow
SendDlgItemMessageA
SetParent
SendMessageA
LoadStringA
DialogBoxParamA
EndDialog
MessageBoxA
shell32
SHGetPathFromIDListA
SHBrowseForFolderA
ntdll
NtOpenProcessToken
NtAdjustPrivilegesToken
NtShutdownSystem
NtClose
Sections
.text Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 5KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
.etext Size: 48KB - Virtual size: 120KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE