Static task
static1
Behavioral task
behavioral1
Sample
0fd4350c1d91f68caf5060fc8eac2365_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
0fd4350c1d91f68caf5060fc8eac2365_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
0fd4350c1d91f68caf5060fc8eac2365_JaffaCakes118
-
Size
2.5MB
-
MD5
0fd4350c1d91f68caf5060fc8eac2365
-
SHA1
bdd3770e7676ed116915de64f97635692a1d2aec
-
SHA256
d2c89f901636cc0149975eca8c862d80abe7ac15df6c75bde9119c4da9f4d70a
-
SHA512
7c2eb6a96340e2fb9e44c8b1705c0a71e16e6e7022444921ecadd42e292c7e22b8b8256002aa38a0dd22d15b85947a1d11d0a698ffbe72f71acd5729bb7be890
-
SSDEEP
49152:paIfjLZaYWhqUx+dRPMcFIpQx4ihbIwZJPlFsh28XUt4JHT5jQ5pG6ue+wg:VLLYrAGshMcF/R6U8XUyRT5+pIe+wg
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0fd4350c1d91f68caf5060fc8eac2365_JaffaCakes118
Files
-
0fd4350c1d91f68caf5060fc8eac2365_JaffaCakes118.exe windows:4 windows x86 arch:x86
1b1f8bafc7e8e1dafb58725e16275805
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCurrentProcess
GetVersionExA
OpenFile
FreeLibrary
GetProcAddress
LoadLibraryA
_lcreat
WinExec
_lopen
GetModuleFileNameA
GetModuleHandleA
GetCommandLineA
SetErrorMode
ExitProcess
_lwrite
GetLastError
lstrcatA
GlobalLock
FormatMessageA
LocalFree
lstrcpyA
GetTempPathA
GetWindowsDirectoryA
GetTempFileNameA
MulDiv
lstrlenA
_lread
_llseek
GlobalUnlock
GlobalFree
GlobalAlloc
_lclose
user32
ExitWindowsEx
wsprintfA
CreateWindowExA
ShowWindow
SetWindowPos
UpdateWindow
SetTimer
LoadIconA
LoadCursorA
RegisterClassA
MessageBoxA
BeginPaint
DrawTextA
EndPaint
InvalidateRect
PostQuitMessage
DefWindowProcA
GetDC
ReleaseDC
GetClientRect
SendMessageA
gdi32
SetTextColor
SetBkMode
SelectObject
StretchDIBits
CreateFontA
TextOutA
RealizePalette
SelectPalette
CreatePalette
GetStockObject
DeleteObject
CreateSolidBrush
GetDeviceCaps
PatBlt
advapi32
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
Sections
.text Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 776B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ