Static task
static1
Behavioral task
behavioral1
Sample
fd3e6408b73985a537f75430fed99e9c_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
fd3e6408b73985a537f75430fed99e9c_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
fd3e6408b73985a537f75430fed99e9c_JaffaCakes118
-
Size
120KB
-
MD5
fd3e6408b73985a537f75430fed99e9c
-
SHA1
87579a2eeaa8e0bebe2d1b0939353645a8e2ce9a
-
SHA256
5f69ac84f28b8834aad5c75445635b894a8867d0102c482268fb3fb02335bc2e
-
SHA512
c8b87775bb9e66eb076d7d415fa4e9e04f480ab9be89ebe576d27c106b9e270410d9337184bed5eb2447a5f5117136d636f3175c6af9e8844ec6756e24cb496d
-
SSDEEP
1536:N5xoLO4VsUIodH3xhF8itiMrqGP4vK8jlGNDBQmcZuOmDBEpw:bxoL9GoV7F8s97KJRE6oOmDBEpw
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fd3e6408b73985a537f75430fed99e9c_JaffaCakes118
Files
-
fd3e6408b73985a537f75430fed99e9c_JaffaCakes118.exe windows:4 windows x86 arch:x86
3ccce83f92fa410441269f84be8cf7bd
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
SHDeleteValueA
PathGetCharTypeA
version
GetFileVersionInfoSizeA
VerFindFileA
VerInstallFileA
kernel32
DeleteFileA
GetFullPathNameA
GetCurrentProcess
VirtualAllocEx
SetEvent
Sleep
GetProcAddress
GlobalDeleteAtom
ExitProcess
GetLocalTime
GetModuleHandleA
GetFileAttributesA
LocalAlloc
GetACP
GetFileSize
comctl32
ImageList_Add
ImageList_DrawEx
ImageList_GetBkColor
ImageList_DragShowNolock
ImageList_Read
shell32
SHFileOperationA
SHGetFileInfoA
DragQueryFileA
Shell_NotifyIconA
SHGetFolderPathA
user32
LoadBitmapA
GetIconInfo
SetCapture
SetWindowPos
GetSubMenu
IsWindowVisible
CharUpperBuffA
ShowOwnedPopups
CheckMenuItem
GetLastActivePopup
CreateWindowExA
DrawEdge
IsWindowUnicode
SetClipboardData
GetFocus
GetCursor
IsWindow
GetScrollPos
LoadKeyboardLayoutA
SetWindowPlacement
OpenClipboard
RegisterClassA
GetWindowPlacement
gdi32
GetDIBColorTable
CreateCompatibleDC
GetDCOrgEx
LineTo
CreatePalette
oleaut32
SysStringLen
RegisterTypeLib
SafeArrayGetElement
SysReAllocStringLen
SafeArrayPtrOfIndex
SafeArrayGetUBound
Sections
CODE Size: 33KB - Virtual size: 33KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 78KB - Virtual size: 78KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: 1024B - Virtual size: 1005B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DATA Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ