Static task
static1
Behavioral task
behavioral1
Sample
0fdd2fc50d9e807b9210015d93b12534_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0fdd2fc50d9e807b9210015d93b12534_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
0fdd2fc50d9e807b9210015d93b12534_JaffaCakes118
-
Size
113KB
-
MD5
0fdd2fc50d9e807b9210015d93b12534
-
SHA1
6cea8831d9ff15ecfa0ca008e49ba70bdec015e7
-
SHA256
888e9744cd8bd0cb23220b3483d2d7616b979a148ef098cbba05e1af254ca8e4
-
SHA512
e156be577341c30d8f5f8d525b387c5fc7d3ab37bce90b477d0e3f9fa77cb370289cd66c7041eedfd43f5dd21d11c349df6c1a418b49a147e58d1d418dd59eeb
-
SSDEEP
1536:0RCMy/HJvJ/mnjUUgBK2+3CAwO+NUuDUeW0OhGdRQk3:gCMYHJJ/aABjBObuDUCOhIQk3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0fdd2fc50d9e807b9210015d93b12534_JaffaCakes118
Files
-
0fdd2fc50d9e807b9210015d93b12534_JaffaCakes118.exe windows:4 windows x86 arch:x86
ba600d434dada7b8391bf3eebec6adb3
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCurrentThread
GetUserDefaultLangID
GetWindowsDirectoryA
RemoveDirectoryA
DeleteFileA
GetModuleHandleW
lstrcmpiW
GetCurrentThreadId
GetStartupInfoA
GetProcessHeap
GetModuleHandleA
GetTickCount
lstrlenW
GetVersion
GetCurrentProcess
GetCurrentProcessId
CopyFileA
DeleteFileW
VirtualAlloc
VirtualFree
lstrcmpA
GlobalFindAtomA
GetDriveTypeA
QueryPerformanceCounter
GetACP
GetOEMCP
IsDebuggerPresent
RemoveDirectoryW
GetCommandLineA
GlobalFindAtomW
GetConsoleOutputCP
lstrlenA
SetCurrentDirectoryA
MulDiv
GetThreadLocale
lstrcmpiA
GetCommandLineW
gdi32
GetTextMetricsA
CreateCompatibleDC
GetDeviceCaps
CreatePalette
SetTextAlign
SetStretchBltMode
SetMapMode
GetStockObject
DeleteObject
CreatePen
CreateSolidBrush
SaveDC
GetObjectA
SelectObject
CreateFontIndirectA
DeleteDC
GetClipBox
SelectPalette
RectVisible
RestoreDC
PatBlt
SetPixel
SetTextColor
GetPixel
LineTo
user32
TranslateMessage
GetSystemMetrics
CharNextA
GetDesktopWindow
GetParent
glu32
gluQuadricCallback
Sections
.text Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 79KB - Virtual size: 78KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ