Static task
static1
Behavioral task
behavioral1
Sample
e83d5801021d0359d95d189e19a7d115_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e83d5801021d0359d95d189e19a7d115_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
e83d5801021d0359d95d189e19a7d115_JaffaCakes118
-
Size
129KB
-
MD5
e83d5801021d0359d95d189e19a7d115
-
SHA1
5a487a09dde05973e87b7db7ec8a6cd55ee033f2
-
SHA256
e2aebfa36e011686b81d94950c2b9c0c95665e142dab0a422fe2171112e1699c
-
SHA512
78f3118d02c2228b455b8f2e8f322498e896996eee4ca8a23dfc089342bb738f69de5011a06d7aa61811fd687e139e098f640734843f25f8bdbc1863d64c1863
-
SSDEEP
3072:8IYu8MyGgniEtIq2TUOTIHVZNKMUI4U+nxg:PV894UJZNKMUFU+x
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e83d5801021d0359d95d189e19a7d115_JaffaCakes118
Files
-
e83d5801021d0359d95d189e19a7d115_JaffaCakes118.exe windows:4 windows x86 arch:x86
2efb0f4072bf02e4efb8382482d44db1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcAddress
GetLocalTime
GetLastError
GlobalFree
CreateThread
InterlockedDecrement
lstrcmpiW
GlobalLock
WriteFile
HeapFree
GetLocaleInfoA
GetModuleHandleA
GetOEMCP
GlobalUnlock
FormatMessageA
GetVersionExA
EndUpdateResourceW
TerminateProcess
LoadLibraryA
FreeEnvironmentStringsW
ExitProcess
msvcrt
_vsnprintf
fclose
wcslen
atol
isdigit
_adjust_fdiv
memcpy
strchr
iscntrl
wcscat
_wtol
isleadbyte
__dllonexit
iswascii
__set_app_type
wcstok
mblen
swprintf
free
_acmdln
wcstol
_wcsicmp
wcscmp
strcpy
__getmainargs
memset
user32
RegisterShellHookWindow
SetWindowTextW
SetScrollPos
DrawTextW
GetMenu
RedrawWindow
DefWindowProcW
DrawIconEx
OemKeyScan
LoadMenuA
CopyRect
EndDialog
DrawEdge
MessageBeep
CharUpperW
FrameRect
FindWindowW
PeekMessageW
IsWindowVisible
GetWindowLongA
AppendMenuW
SystemParametersInfoA
GetMessageA
IsDlgButtonChecked
gdi32
CreateSolidBrush
MoveToEx
CreatePalette
Rectangle
SetBkColor
CreateFontIndirectW
LineTo
ExtTextOutW
PatBlt
TranslateCharsetInfo
GetTextExtentPointW
StretchBlt
CreateCompatibleDC
DeleteObject
GetTextExtentPoint32W
GetTextMetricsW
tapi32
lineDrop
lineSetAgentStateEx
lineCreateAgentSessionW
phoneGetButtonInfo
lineGetAddressCaps
phoneGetMessage
lineConfigDialogEdit
lineGetDevConfigW
comdlg32
GetOpenFileNameW
shell32
SHGetFolderPathW
SHGetPathFromIDListW
SHGetMalloc
ShellExecuteW
SHGetSpecialFolderLocation
ShellAboutW
winmm
mixerGetLineInfoA
auxOutMessage
mmioDescend
mmGetCurrentTask
Sections
.text Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
nes1 Size: 512B - Virtual size: 278B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
nes2 Size: 512B - Virtual size: 360B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
nes3 Size: 512B - Virtual size: 401B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
nes4 Size: 512B - Virtual size: 306B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 112KB - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 62B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ