Static task
static1
Behavioral task
behavioral1
Sample
4b75c4fddb3901c5223c4d5198234c41_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
4b75c4fddb3901c5223c4d5198234c41_JaffaCakes118
-
Size
157KB
-
MD5
4b75c4fddb3901c5223c4d5198234c41
-
SHA1
22cc87df1da200f0931329dfee112c0ec79c29d9
-
SHA256
620c4af2c92167c536d7f2d68593c3e14dff026f3cc2e20f1a3acc266c2f8b40
-
SHA512
0d3b4511ca0aedfe204019b7a7d0d300e53bf20d928251f06e4be7b0f7d9ac9b3f35d56b1b237355952b73419aaaa58033071e3f2c5d01617f6a10f559a63c0f
-
SSDEEP
3072:oDibcJaOiDRNBYVU/GD5QpoAS7XxpKFCgpmmFtSQak:2nJaJRIU/GDqhYxpKUgpmmFt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4b75c4fddb3901c5223c4d5198234c41_JaffaCakes118
Files
-
4b75c4fddb3901c5223c4d5198234c41_JaffaCakes118.exe windows:4 windows x86 arch:x86
c3b7c75ed86f7dca59024f5b007f7133
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
fgets
isprint
vfprintf
netapi32
NetGroupDel
winspool.drv
AddFormW
OpenPrinterW
StartDocPrinterW
winscard
g_rgSCardT1Pci
mprapi
MprConfigInterfaceTransportRemove
shlwapi
ChrCmpIA
user32
EndDialog
DdeConnect
UnionRect
wininet
InternetGetCookieW
InternetSetOptionW
gdi32
GetTextCharsetInfo
GetRasterizerCaps
GetDCPenColor
ScaleViewportExtEx
rpcrt4
RpcServerUseProtseqW
RpcServerUseProtseqExW
urlmon
CreateAsyncBindCtxEx
ntdsapi
DsReplicaGetInfo2W
shell32
SHAppBarMessage
advapi32
SetServiceBits
RegDisablePredefinedCache
wintrust
CryptCATAdminAcquireContext
kernel32
PostQueuedCompletionStatus
SetUserGeoID
GetTickCount
GetModuleHandleA
GetBinaryTypeW
GetBinaryTypeA
SetSystemFileCacheSize
SetFileBandwidthReservation
GetLogicalProcessorInformation
FindFirstChangeNotificationA
Sections
.text Size: 118KB - Virtual size: 117KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 32KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ