Static task
static1
Behavioral task
behavioral1
Sample
0150ceac0f28a26fd54dc3af9f78c696_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0150ceac0f28a26fd54dc3af9f78c696_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
0150ceac0f28a26fd54dc3af9f78c696_JaffaCakes118
-
Size
425KB
-
MD5
0150ceac0f28a26fd54dc3af9f78c696
-
SHA1
1946fb58bfa9859882268ee095fe70230503c2c2
-
SHA256
1f3883cf8b84040817111ab94425a0275d11e3ca0369f5a9bacfac3cc1cca6d5
-
SHA512
9fee24c854f9c03fed7c4649d91c483c1f632e87a5196deb5eab80f546053eff30878de3d54e4af31f38cee5aaa0ba0e1a9cfba1fdb9a57a753db2e9c107b99b
-
SSDEEP
6144:r7Cppu8xHdlFL5O2oHlN4fLcsK7hPxumtUWwQIfUoP9QfrWhr+qiQb66VgBNjOHF:sc8xHl9Op++hDUWyfk2iQblxAKJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0150ceac0f28a26fd54dc3af9f78c696_JaffaCakes118
Files
-
0150ceac0f28a26fd54dc3af9f78c696_JaffaCakes118.exe windows:4 windows x86 arch:x86
34c2c0eb681dcb21776cd7477ab5ac86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
gdi32
GetBitmapBits
CreatePenIndirect
RemoveFontResourceA
GetGlyphOutlineW
GetWorldTransform
PlayMetaFileRecord
PtVisible
GetMetaRgn
EndDoc
Polygon
GetCharWidthFloatA
MoveToEx
AbortPath
GetTextExtentPointA
GetTextFaceA
SetDIBits
DPtoLP
SetPaletteEntries
EndPath
SetDIBColorTable
SetMagicColors
GetMetaFileW
GetTextExtentExPointW
comdlg32
PageSetupDlgA
GetSaveFileNameA
PageSetupDlgW
ReplaceTextA
advapi32
RegLoadKeyW
CryptEnumProviderTypesW
CryptAcquireContextW
InitializeSecurityDescriptor
CryptContextAddRef
RegQueryValueExA
LogonUserW
CryptEnumProvidersW
RegQueryValueW
RegOpenKeyExA
RegCreateKeyW
CryptDuplicateKey
RegFlushKey
RegCreateKeyExA
AbortSystemShutdownW
shell32
DragQueryFileAorW
kernel32
FreeEnvironmentStringsA
GetModuleFileNameA
VirtualFree
GetVersion
GetModuleHandleA
HeapReAlloc
UnhandledExceptionFilter
HeapDestroy
InterlockedExchange
GetTickCount
LoadLibraryA
GetVolumeInformationA
GetStartupInfoW
EnterCriticalSection
GetEnvironmentStringsW
WriteFile
SetLastError
TlsSetValue
VirtualAlloc
ExitProcess
GetCurrentThreadId
lstrcatA
GetLastError
ReadConsoleW
QueryPerformanceCounter
GetSystemTimeAsFileTime
IsBadWritePtr
FindResourceA
VirtualQueryEx
GetProcAddress
HeapAlloc
InitializeCriticalSection
HeapFree
GetFileType
HeapCreate
MultiByteToWideChar
GetCommandLineA
GetProcessAffinityMask
GetPrivateProfileStructW
GetStartupInfoA
FreeEnvironmentStringsW
TlsGetValue
TerminateProcess
RaiseException
TlsAlloc
GetNamedPipeHandleStateW
GetCurrentProcessId
EnumSystemCodePagesA
GetEnvironmentStrings
VirtualQuery
WritePrivateProfileStringW
GetCurrentThread
GetCommandLineW
GetModuleFileNameW
SetHandleCount
GetStdHandle
GetCurrentProcess
DeleteCriticalSection
RtlUnwind
TlsFree
LeaveCriticalSection
wininet
InternetConfirmZoneCrossing
FreeUrlCacheSpaceA
Sections
.text Size: 141KB - Virtual size: 140KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 278KB - Virtual size: 277KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ