Static task
static1
Behavioral task
behavioral1
Sample
documenty.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
documenty.exe
Resource
win10v2004-20240419-en
General
-
Target
04b3423959eba454be36293cad05e6fb_JaffaCakes118
-
Size
88KB
-
MD5
04b3423959eba454be36293cad05e6fb
-
SHA1
0437e4d6ca083c279483d65e36823382e2d9b9f5
-
SHA256
be5a169d4a405e93ee9b59e75704b594a3856a5289c0596fe80c45059d0f3b9c
-
SHA512
1cf42862457ba1caedabcf107e6b12d065f0d596d4a2beb918f4d6b92111da1ed8dbf402aba8ed8cd580321385971e7f329be3d2243e46e1106bd8f41fb18122
-
SSDEEP
1536:WN25HqKy75aXT1ZLDlWbZAyUH6CJTfhczBEmoHtFx2tnrhmi+rfzY0CkCR5:WUlGCri6aCJTfhczBEjHP6sTvMkCR5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource unpack001/documenty.exe
Files
-
04b3423959eba454be36293cad05e6fb_JaffaCakes118.rar
-
documenty.exe.exe windows:4 windows x86 arch:x86
7db5b6d58b526ec4766a75ebf01ce9b9
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
DuplicateHandle
EncodeSystemPointer
EnumerateLocalComputerNamesW
ExitProcess
FindAtomW
GenerateConsoleCtrlEvent
GetCommModemStatus
GetCommandLineA
GetConsoleCursorInfo
GetConsoleProcessList
GetMailslotInfo
GetModuleHandleA
GetNamedPipeHandleStateA
GetProcessId
GetThreadContext
GetThreadIOPendingFlag
GetThreadPriorityBoost
GlobalCompact
IsBadHugeWritePtr
IsBadStringPtrA
IsBadStringPtrW
DeleteAtom
LocalSize
PeekNamedPipe
PostQueuedCompletionStatus
ReleaseSemaphore
RemoveVectoredExceptionHandler
RequestWakeupLatency
SetConsoleCursor
SetConsoleCursorPosition
SetConsoleOutputCP
SetConsoleScreenBufferSize
SetEvent
SetHandleInformation
SetInformationJobObject
SetMailslotInfo
SetThreadContext
SetThreadExecutionState
SetThreadLocale
SetThreadPriority
SetUnhandledExceptionFilter
VirtualAlloc
DebugActiveProcess
CreateJobSet
ConvertDefaultLocale
ClearCommError
CancelWaitableTimer
LocalFree
AddAtomA
user32
DdeSetUserHandle
DefFrameProcW
DefWindowProcA
DeleteMenu
DeregisterShellHookWindow
DestroyWindow
DispatchMessageA
DdeQueryStringW
DrawIconEx
DrawMenuBar
EnableScrollBar
FrameRect
GetAltTabInfoW
GetAsyncKeyState
GetClassNameW
GetClipboardData
GetDC
GetKeyState
GetLastActivePopup
GetListBoxInfo
GetMenuBarInfo
GetMenuDefaultItem
GetMenuItemCount
GetMessageA
GetNextDlgGroupItem
GetRegisteredRawInputDevices
GetSysColorBrush
GetSystemMetrics
GetWindowModuleFileNameA
IMPQueryIMEW
InvalidateRect
IsCharAlphaNumericA
IsGUIThread
IsWindowUnicode
LoadCursorA
LoadIconA
MessageBeep
MessageBoxA
MonitorFromPoint
MoveWindow
NotifyWinEvent
OpenClipboard
OpenInputDesktop
PeekMessageW
PostQuitMessage
PostThreadMessageA
PrintWindow
RegisterClassExA
SendDlgItemMessageA
SendMessageA
SendMessageCallbackA
SendMessageW
SendNotifyMessageW
SetActiveWindow
SetClipboardViewer
SetDebugErrorLevel
SetShellWindow
SetThreadDesktop
SetWinEventHook
ShowWindow
TrackPopupMenu
TrackPopupMenuEx
TranslateMessage
UpdateWindow
DdeQueryConvInfo
DdeGetLastError
DdeCreateStringHandleA
DdeConnectList
DdeClientTransaction
DdeAddData
DdeAbandonTransaction
CreateWindowExA
CreateCaret
CopyImage
CloseWindowStation
CheckRadioButton
ArrangeIconicWindows
AllowSetForegroundWindow
DrawAnimatedRects
comdlg32
dwLBSubclass
ddraw
DirectDrawCreateClipper
DSoundHelp
glu32
gluBuild1DMipmaps
rpcrt4
NdrDllRegisterProxy
NdrGetSimpleTypeMemorySize
RpcErrorStartEnumeration
RpcMgmtSetAuthorizationFn
RpcObjectSetInqFn
I_RpcServerSetAddressChangeFn
I_RpcMapWin32Status
winmm
mciSetDriverData
mxd32Message
tid32Message
timeBeginPeriod
timeEndPeriod
wod32Message
DrvGetModuleHandle
Sections
.text Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 136KB - Virtual size: 135KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE