Static task
static1
Behavioral task
behavioral1
Sample
f8d62bc2e174e624fd63ded004a3ca94_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f8d62bc2e174e624fd63ded004a3ca94_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f8d62bc2e174e624fd63ded004a3ca94_JaffaCakes118
-
Size
10.1MB
-
MD5
f8d62bc2e174e624fd63ded004a3ca94
-
SHA1
2b3e1baa0a7407f1627e6349d044eada991b5452
-
SHA256
d4ca44f11b84cb185a779b6beb43f3317ffe91cf08d67a8da639764151a79d1e
-
SHA512
7b67a2403813a48103fdda53dd665b3e96d9b859dfdfbd044e85f52bdd3e17953f044e78c22e2935e17724df8b10491f9727dbce5d88c8e37ca35f17bef565f6
-
SSDEEP
24576:6URprj37+W55555555555555555555555555555555555555555555555555555n:1TP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource f8d62bc2e174e624fd63ded004a3ca94_JaffaCakes118
Files
-
f8d62bc2e174e624fd63ded004a3ca94_JaffaCakes118.exe windows:5 windows x86 arch:x86
6887e4e157df0117e9ddb7e7f8c4d5c5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
odbctrac
TraceSQLFetch
TraceSQLCancel
TraceSQLError
TraceSQLConnect
authz
AuthzAddSidsToContext
AuthzFreeAuditEvent
AuthzFreeContext
AuthzFreeResourceManager
shlwapi
UrlCanonicalizeA
PathCompactPathW
PathCommonPrefixW
UrlHashW
UrlUnescapeW
UrlCompareW
UrlIsA
PathIsRootA
UrlCreateFromPathA
UrlGetLocationW
UrlEscapeA
kernel32
LeaveCriticalSection
LoadLibraryExA
SearchPathW
OpenFileMappingW
lstrcatW
GetDateFormatA
GetCommandLineW
LoadLibraryA
GetShortPathNameA
GetCurrentProcess
WaitForSingleObjectEx
lstrcat
MoveFileW
CreateMailslotA
GetProcAddress
GetSystemDirectoryW
user32
LoadMenuW
GetDlgItemTextA
GetPropA
DrawStateA
LoadBitmapA
LoadIconA
CharToOemA
GetWindow
InsertMenuA
LoadCursorA
wsprintfW
DialogBoxParamA
IsCharLowerA
CreateWindowExA
PeekMessageA
cmpbk32
PhoneBookLoad
PhoneBookFreeFilter
Sections
.text Size: 130KB - Virtual size: 130KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 10.0MB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ