Static task
static1
Behavioral task
behavioral1
Sample
ede6203442e90654c3f462a02799f901_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ede6203442e90654c3f462a02799f901_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
ede6203442e90654c3f462a02799f901_JaffaCakes118
-
Size
596KB
-
MD5
ede6203442e90654c3f462a02799f901
-
SHA1
df9317cc266012ed6e98fef5b6ba3aff2bdfb2c5
-
SHA256
1a0c3d19a75eb8e665a21ed9d481f7d84c16ed2e0d52eee6fee2508414a6b8da
-
SHA512
227198edb734ed23ad432e920e1a5de7e101880e3011d570bc92fb9957c043fcbed3e49810300452b72fcd03586170943fd60dbe5887855771874e1ab67e9866
-
SSDEEP
12288:viT9jOh911vrIE9ozYUaIQAW8fNDAfvEhCf/wrjKItW6GvQ9eCkEdO:KhjODrIE9uYU3QAW8fB0MQXw3KYTbkEQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ede6203442e90654c3f462a02799f901_JaffaCakes118
Files
-
ede6203442e90654c3f462a02799f901_JaffaCakes118.exe windows:4 windows x86 arch:x86
7b12f08a9f2c87fa2428f74f33afd2f5
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
gdi32
Pie
ExtTextOutW
SaveDC
PlayMetaFileRecord
CombineRgn
SetWorldTransform
ResetDCA
CreateBitmapIndirect
GetBkMode
StretchBlt
PolyPolyline
LineTo
comctl32
InitCommonControlsEx
user32
MapWindowPoints
LoadBitmapA
DlgDirSelectExW
MapVirtualKeyW
OemToCharW
GetShellWindow
VkKeyScanW
GetClassInfoA
VkKeyScanExA
GetCursor
GetClipboardViewer
InflateRect
OpenIcon
SetProcessWindowStation
CreateMDIWindowW
GetFocus
SetWindowsHookExW
GetGuiResources
SetCursor
CharPrevW
GetCapture
GetTitleBarInfo
SendNotifyMessageA
DdeGetLastError
RegisterClassA
RegisterClassExA
ScreenToClient
advapi32
LookupAccountNameA
CryptEnumProvidersW
RegFlushKey
kernel32
GetConsoleOutputCP
GetCurrentThreadId
HeapSize
SetEnvironmentVariableA
GetFileType
GetStdHandle
HeapFree
ExitProcess
Sleep
EnumSystemLocalesA
RtlUnwind
SetLocalTime
InterlockedIncrement
SetUnhandledExceptionFilter
HeapAlloc
WriteConsoleA
GetEnvironmentStrings
VirtualFree
EnterCriticalSection
CompareStringA
GetModuleHandleA
TlsFree
GetLocaleInfoA
CreateFileA
FreeLibrary
MultiByteToWideChar
OpenMutexA
LoadModule
GetCurrencyFormatA
LoadLibraryA
SetFilePointer
GetVersionExA
TlsAlloc
SetHandleCount
CreateMutexA
GetNamedPipeInfo
InterlockedDecrement
VirtualQuery
VirtualAlloc
UnmapViewOfFile
CompareStringW
SetConsoleCtrlHandler
QueryPerformanceCounter
FreeEnvironmentStringsA
GetTimeZoneInformation
GetSystemTimeAsFileTime
WideCharToMultiByte
DeleteCriticalSection
SetLastError
GetStartupInfoA
GetProcessHeap
FoldStringW
GetTickCount
GetCurrentProcess
GetCurrentThread
GetConsoleCP
GetStringTypeA
FreeEnvironmentStringsW
TerminateProcess
FlushFileBuffers
EnumResourceTypesA
GetTimeFormatA
GetUserDefaultLCID
HeapDestroy
LCMapStringA
SetStdHandle
GetLastError
LeaveCriticalSection
WriteFile
IsValidCodePage
GetCPInfo
GetMailslotInfo
TlsSetValue
InterlockedExchange
GetDateFormatA
GetStringTypeW
LCMapStringW
TlsGetValue
LoadLibraryW
ReadFile
IsDebuggerPresent
GetProcAddress
UnhandledExceptionFilter
GetCommandLineA
InitializeCriticalSection
HeapCreate
GetAtomNameA
IsValidLocale
GetConsoleMode
WriteConsoleW
GetEnvironmentStringsW
GetACP
GetOEMCP
lstrlenA
GetModuleFileNameA
GetCurrentProcessId
HeapReAlloc
CloseHandle
SetPriorityClass
GetLocaleInfoW
wininet
DeleteUrlCacheEntry
FtpGetCurrentDirectoryA
Sections
.text Size: 262KB - Virtual size: 262KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 10KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 318KB - Virtual size: 317KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ