confessions
Static task
static1
Behavioral task
behavioral1
Sample
94a5191b6551c5d5641a3d94195df8dd_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
94a5191b6551c5d5641a3d94195df8dd_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
94a5191b6551c5d5641a3d94195df8dd_JaffaCakes118
-
Size
311KB
-
MD5
94a5191b6551c5d5641a3d94195df8dd
-
SHA1
2d9d48efaadd6c5f6bf0b5743ac8682baf6f1765
-
SHA256
0777f3ccda3d8b4ee25ed70e9896bfa0d4b239a43a5d1a0d2eb9395584018ab6
-
SHA512
69dcd31d5e23b49045ff2094b87e0dcad192442b548d6c4957e211c20ba5a46f8c3f9150aed845d94a5483ae885c9c40d67b18c7b4b3a0f2a5808ac8df7668e6
-
SSDEEP
6144:FFikbe4szQalIeSPY7PhvIb0wLYjkVetdSwZj:FFZ+ZglYjkVetX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 94a5191b6551c5d5641a3d94195df8dd_JaffaCakes118
Files
-
94a5191b6551c5d5641a3d94195df8dd_JaffaCakes118.exe windows:4 windows x86 arch:x86
e071230edb0a4195e96dae40a7b39399
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
comdlg32
ChooseColorA
gdi32
CreateSolidBrush
kernel32
DeleteCriticalSection
EnterCriticalSection
ExitProcess
GetCommandLineA
GetLastError
GetModuleHandleA
GetProcAddress
GetStartupInfoA
InitializeCriticalSection
LeaveCriticalSection
SetUnhandledExceptionFilter
TlsGetValue
VirtualAlloc
VirtualProtect
VirtualQuery
WinExec
msvcrt
__getmainargs
__p__environ
__p__fmode
__set_app_type
_cexit
_iob
_onexit
_setmode
abort
atexit
calloc
fclose
fopen
fprintf
free
fwrite
memcpy
memset
signal
vfprintf
user32
CreateWindowExA
DefWindowProcA
DialogBoxParamA
DispatchMessageA
EnableWindow
EndDialog
GetDlgItem
GetDlgItemInt
GetDlgItemTextA
GetMessageA
IsDlgButtonChecked
LoadCursorA
LoadIconA
PostQuitMessage
RedrawWindow
RegisterClassA
SendDlgItemMessageA
SendMessageA
ShowWindow
TranslateMessage
Exports
Exports
Sections
.text Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 34KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.eh_fram Size: 1024B - Virtual size: 1016B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 108B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 512B - Virtual size: 72B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 708B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.3hp0 Size: 222KB - Virtual size: 221KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ