Static task
static1
Behavioral task
behavioral1
Sample
fca0ab7a4e9308a6c44ca1fd0a458838_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fca0ab7a4e9308a6c44ca1fd0a458838_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
fca0ab7a4e9308a6c44ca1fd0a458838_JaffaCakes118
-
Size
571KB
-
MD5
fca0ab7a4e9308a6c44ca1fd0a458838
-
SHA1
32c2344a077f55d351ca666f0346ed8d23947ff2
-
SHA256
2902b9354876b982fcd6a104fd742b7c523b20c6b871b6e760e4741e285ea2b5
-
SHA512
6209e0cb317360a25a3337893bedea30efdd4c4bc71b40e9878a463bed737868bfe881514ed32ab8cc47af2239276e6a28bab36a6d2d2ce3c1c2e1465ab49f5b
-
SSDEEP
12288:81fBXC4VehR+RFv3GWlmRQG/ij0XG6rSvHwd:wfBXCH/M/j0R3/ijlwd
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fca0ab7a4e9308a6c44ca1fd0a458838_JaffaCakes118
Files
-
fca0ab7a4e9308a6c44ca1fd0a458838_JaffaCakes118.exe windows:4 windows x86 arch:x86
d37194af4c208c20555e4774e90da13a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
comctl32
InitCommonControlsEx
gdi32
GetEnhMetaFileHeader
AbortPath
GetPaletteEntries
GetTextExtentPointA
CreatePolygonRgn
EnumFontFamiliesW
GetTextAlign
GetCharABCWidthsFloatW
ScaleWindowExtEx
GetSystemPaletteUse
DeviceCapabilitiesExA
GetKerningPairsA
SetArcDirection
UnrealizeObject
GetObjectA
GetPath
SetViewportExtEx
user32
RegisterClassExA
DispatchMessageW
UnregisterHotKey
RegisterClassA
RemovePropW
CallMsgFilterW
PostQuitMessage
GetClipboardSequenceNumber
CharLowerBuffA
EndMenu
LoadMenuW
DlgDirSelectComboBoxExA
AdjustWindowRectEx
IsDialogMessageW
DdeQueryStringW
KillTimer
HideCaret
IsWindowVisible
GetWindowContextHelpId
DefFrameProcA
RegisterClassW
GetLastActivePopup
SetWindowRgn
OpenWindowStationW
SetScrollRange
SetDoubleClickTime
kernel32
LoadLibraryA
lstrcmp
GetCurrentProcess
HeapFree
GetStdHandle
GetLocaleInfoW
GetTickCount
GetTimeFormatA
GetCurrentThread
VirtualAlloc
GetCPInfo
InterlockedExchange
HeapSize
GetProcAddress
GetLocalTime
GetModuleHandleA
IsBadWritePtr
CreateDirectoryExW
GetLastError
VirtualFree
VirtualProtect
HeapAlloc
IsValidCodePage
GetDateFormatA
ExitProcess
SetLastError
LCMapStringA
LCMapStringW
SetStdHandle
ReadFile
FreeEnvironmentStringsW
IsValidLocale
SetCriticalSectionSpinCount
TlsGetValue
GetSystemInfo
EnumResourceNamesA
MultiByteToWideChar
GetEnvironmentStrings
RtlUnwind
TlsSetValue
lstrcmpi
LoadLibraryExA
CloseHandle
GetTimeZoneInformation
CreateMutexA
SetEnvironmentVariableA
DeleteCriticalSection
EnumSystemLocalesW
InitializeCriticalSection
GetCurrentThreadId
GetEnvironmentVariableW
GetStringTypeA
GetACP
GetCommandLineA
WaitForMultipleObjects
WideCharToMultiByte
MoveFileA
WriteConsoleA
SetHandleCount
CompareStringA
GetOEMCP
GetEnvironmentStringsW
GetStringTypeW
SleepEx
GetUserDefaultLCID
SetFilePointer
GetStartupInfoA
HeapReAlloc
GetModuleFileNameA
GetFileType
WriteFile
CompareStringW
UnhandledExceptionFilter
GlobalUnfix
FlushFileBuffers
GetSystemTimeAsFileTime
GetVersionExA
TerminateThread
TlsFree
GetLocaleInfoA
EnterCriticalSection
GetShortPathNameA
VirtualQuery
TerminateProcess
TlsAlloc
QueryPerformanceCounter
GetAtomNameW
HeapCreate
HeapDestroy
EnumSystemLocalesA
GetCurrentProcessId
OpenMutexA
FreeEnvironmentStringsA
LeaveCriticalSection
wininet
InternetFortezzaCommand
shell32
DoEnvironmentSubstA
ExtractIconEx
SheChangeDirA
SHGetDataFromIDListA
InternalExtractIconListA
Sections
.text Size: 232KB - Virtual size: 232KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 9KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 317KB - Virtual size: 317KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ