Static task
static1
Behavioral task
behavioral1
Sample
0a49b4bbfdc7984e9e9dcc8ba486d2d7_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
0a49b4bbfdc7984e9e9dcc8ba486d2d7_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
0a49b4bbfdc7984e9e9dcc8ba486d2d7_JaffaCakes118
-
Size
170KB
-
MD5
0a49b4bbfdc7984e9e9dcc8ba486d2d7
-
SHA1
0ab3fdf57975368417b5766304c95c5590dbb9a3
-
SHA256
c69570c5ce3740dfa15f131a2efd96b5432896871f3269db6191bf417df4359d
-
SHA512
1f2c3150fa6572d54af2c929f0ae6d6dd9d4c3aef1acc03b20dca185f9946f6b065672d6a034a35e44d65d62288044a0a93cb039a1dbad8815701107da5e2bb0
-
SSDEEP
3072:L+H5hOSWKdmlPCxBrm/myj2mKlB2FsTzKwVA8s6un:e5pG8fym+GKwVFe
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0a49b4bbfdc7984e9e9dcc8ba486d2d7_JaffaCakes118
Files
-
0a49b4bbfdc7984e9e9dcc8ba486d2d7_JaffaCakes118.exe windows:4 windows x86 arch:x86
98e65cc0249313ade87e07c665e83b93
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetUserDefaultLangID
GetOEMCP
DeleteFileW
RemoveDirectoryA
lstrcmpA
lstrcmpiW
MulDiv
CopyFileA
DeleteFileA
IsDebuggerPresent
GetCurrentProcess
GetCommandLineW
GetCurrentThread
GetWindowsDirectoryA
QueryPerformanceCounter
lstrlenA
GetModuleHandleW
GetTickCount
GlobalFindAtomW
GetModuleHandleA
GetACP
lstrcmpiA
GetCommandLineA
GlobalFindAtomA
lstrlenW
GetDriveTypeA
GetCurrentThreadId
GetStartupInfoA
GetVersion
GetConsoleOutputCP
GetProcessHeap
VirtualAlloc
GetThreadLocale
VirtualFree
user32
GetDesktopWindow
GetParent
TranslateMessage
GetSystemMetrics
CharNextA
GetDC
gdi32
SetTextAlign
GetTextMetricsA
RectVisible
SaveDC
CreateSolidBrush
SelectPalette
RestoreDC
CreateCompatibleDC
GetPixel
GetClipBox
CreatePalette
SelectObject
GetStockObject
SetStretchBltMode
DeleteDC
LineTo
DeleteObject
SetMapMode
PatBlt
CreateFontIndirectA
GetDeviceCaps
CreatePen
SetTextColor
GetObjectA
glu32
gluNurbsCallback
Sections
.text Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Ftbhq Ud Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 26KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Hvej, Dd Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 100KB - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 30KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ