Static task
static1
Behavioral task
behavioral1
Sample
271a83616c5c8367404339f1c0a29b0f_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
271a83616c5c8367404339f1c0a29b0f_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
271a83616c5c8367404339f1c0a29b0f_JaffaCakes118
-
Size
24.5MB
-
MD5
271a83616c5c8367404339f1c0a29b0f
-
SHA1
7742da63f8725981ae8d68dfaff395c6339ca1a3
-
SHA256
8b7d3563183afbf9a33791a296a4d28e53d98a25e20092c84a5544e8841dcf49
-
SHA512
74f3dbb8eac3d884007118b0a805b9767649f5b34f26828f4fcccf5ad13e141f1ce5a996c201c818f62c321c8de0b6477ab6dc3468d65101bd87407c12c318ba
-
SSDEEP
393216:G+H4Ai34L+0xFwoFYKCpoy059fnfOVysPOzUz0xEP1475YsU20H9FdFuLP0:V4A+0x2iSmf2Vys50xmqFYn2OsLP0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 271a83616c5c8367404339f1c0a29b0f_JaffaCakes118
Files
-
271a83616c5c8367404339f1c0a29b0f_JaffaCakes118.exe windows:4 windows x86 arch:x86
5190c48524d010bf5a5726d8e2cf2d26
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
SetFilePointer
GetLastError
ReadFile
WriteFile
GetFileAttributesA
CreateFileA
CreateDirectoryA
lstrlenA
SetFileAttributesA
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
SystemTimeToFileTime
FileTimeToDosDateTime
HeapAlloc
HeapFree
FindFirstFileA
GetTempPathA
GetWindowsDirectoryA
GetSystemDirectoryA
GetCurrentDirectoryA
ExitProcess
GetCommandLineA
GetModuleFileNameA
GetModuleHandleA
lstrcatA
lstrcmpA
IsDBCSLeadByte
lstrcpyA
FormatMessageA
GetProcessHeap
FileTimeToLocalFileTime
FindClose
LocalFree
user32
GetMessageA
PeekMessageA
wsprintfA
GetDlgItem
SetWindowTextA
TranslateMessage
EndDialog
DispatchMessageA
MoveWindow
PostMessageA
SendMessageA
CharNextA
DialogBoxParamA
GetWindowRect
GetSystemMetrics
LoadStringA
GetDlgItemTextA
MessageBoxA
advapi32
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
shell32
SHGetMalloc
SHBrowseForFolderA
SHGetPathFromIDListA
ShellExecuteA
ole32
CoInitialize
CoUninitialize
Sections
.text Size: 16KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ