Static task
static1
Behavioral task
behavioral1
Sample
ebe49d949d3c5d81df52992453fbf22f_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ebe49d949d3c5d81df52992453fbf22f_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
ebe49d949d3c5d81df52992453fbf22f_JaffaCakes118
-
Size
579KB
-
MD5
ebe49d949d3c5d81df52992453fbf22f
-
SHA1
533d912db6db019d8a4d829f4da26566fe56a496
-
SHA256
576bffeb8509067e9fe7b82f5e1deb72632deea51087e2f6addf0609f2c44651
-
SHA512
84d8fe3e27e558d99ffde69200b4206143cab1c13cc08f03ccf2a60adfa68a999ac02044bea3b9a36a9a720249131489b56258aae9109ed141a632b05b671572
-
SSDEEP
12288:BXuRhw+AFNCud8eldbw05XAF0TJxbNUO38w1nbYMdQBZ:BX4S6uHbwGrJxb2xweMqZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ebe49d949d3c5d81df52992453fbf22f_JaffaCakes118
Files
-
ebe49d949d3c5d81df52992453fbf22f_JaffaCakes118.exe windows:4 windows x86 arch:x86
11fb3d560a217e7488d3e407aeef4330
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
comctl32
InitCommonControlsEx
shell32
ExtractIconW
advapi32
LogonUserW
CryptCreateHash
RegEnumKeyExW
RegDeleteValueA
InitiateSystemShutdownW
LookupSecurityDescriptorPartsA
RegRestoreKeyW
RegCreateKeyExA
LookupSecurityDescriptorPartsW
CryptSetProviderExW
CryptGetProvParam
CryptEnumProviderTypesA
RegNotifyChangeKeyValue
RegConnectRegistryW
RegSaveKeyW
CryptSignHashA
GetUserNameW
CryptEnumProviderTypesW
RegReplaceKeyW
RegSetValueA
gdi32
CreateFontIndirectA
SetPixel
CreateDIBSection
GetSystemPaletteUse
FrameRgn
BitBlt
GetROP2
GetSystemPaletteEntries
GetTextExtentPoint32W
SetPixelV
PolyTextOutW
PlayEnhMetaFile
CreateFontA
FillPath
kernel32
GetTimeZoneInformation
EnumSystemLocalesA
WideCharToMultiByte
GetDateFormatA
LeaveCriticalSection
WritePrivateProfileSectionW
WriteFile
FreeEnvironmentStringsA
GetEnvironmentStringsW
EnumCalendarInfoExA
GetACP
IsBadWritePtr
GetFullPathNameW
InterlockedExchange
TlsGetValue
TlsFree
QueryPerformanceCounter
GetEnvironmentStrings
LCMapStringA
SetHandleCount
IsValidLocale
GetLastError
GetStartupInfoA
SetStdHandle
LCMapStringW
GetLocaleInfoA
GetModuleHandleA
GlobalAddAtomW
GetLocaleInfoW
FreeEnvironmentStringsW
GetUserDefaultLCID
VirtualAlloc
HeapFree
GetFileType
HeapReAlloc
GetStringTypeA
GetTimeFormatA
GetCurrentThreadId
EnumResourceNamesW
HeapDestroy
DeleteCriticalSection
InitializeCriticalSection
GetTickCount
GetStringTypeW
GetCommandLineW
SetFileTime
ReadConsoleOutputCharacterA
RtlUnwind
ReadFile
GetOEMCP
SetFilePointer
GetCurrentProcessId
VirtualFree
HeapSize
GetStartupInfoW
IsValidCodePage
HeapCreate
ExitProcess
CompareStringA
EnterCriticalSection
GlobalHandle
VirtualQuery
GetVersionExA
GetThreadPriority
UnhandledExceptionFilter
TlsSetValue
GetStdHandle
MultiByteToWideChar
GetProcAddress
GetModuleHandleW
TlsAlloc
SetConsoleWindowInfo
GetSystemTimeAsFileTime
CompareStringW
CloseHandle
GetModuleFileNameA
VirtualProtect
HeapAlloc
LoadLibraryA
TerminateProcess
GetCommandLineA
GetSystemInfo
InitializeCriticalSectionAndSpinCount
WritePrivateProfileStructA
GetCPInfo
GetModuleFileNameW
LockFile
GetThreadTimes
CreateMutexA
GetCurrentProcess
SetEnvironmentVariableA
FlushFileBuffers
SetLastError
OpenMutexA
GetCurrentThread
user32
DdeQueryNextServer
GetDlgItem
GetMessagePos
IsCharAlphaNumericA
FindWindowA
SetLastErrorEx
GetClipboardOwner
RegisterClassExA
RegisterClassA
OemToCharBuffA
SetCursor
DrawTextExW
LoadKeyboardLayoutA
MessageBoxExA
comdlg32
PrintDlgA
Sections
.text Size: 198KB - Virtual size: 197KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 9KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 360KB - Virtual size: 359KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ