Static task
static1
Behavioral task
behavioral1
Sample
0c4d13b61b6ba763d36a431c62838c50_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
0c4d13b61b6ba763d36a431c62838c50_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
0c4d13b61b6ba763d36a431c62838c50_JaffaCakes118
-
Size
83KB
-
MD5
0c4d13b61b6ba763d36a431c62838c50
-
SHA1
5f6015a00a71fa677fd4b03a6d554142d3e1328b
-
SHA256
efb9b3414176838fc691304fe1867f5e8203e1b8fbbf78fe3102e22dbaa58d1e
-
SHA512
adf4b10eedbdd828cc979ec56d2b63a8ffbeab15834062ad8843a3282b4e2ca0f7f87412e4d4500c4074f6cfea877c8d3434e1fdc51ef8be061118e45ff0ce91
-
SSDEEP
1536:xbzEfAk3CwC4xWwtfUnai4t/eqvXbJKqO:x3EfAmCof1Dt/eqvrJK5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0c4d13b61b6ba763d36a431c62838c50_JaffaCakes118
Files
-
0c4d13b61b6ba763d36a431c62838c50_JaffaCakes118.exe windows:4 windows x86 arch:x86
ea8dfa62fb45d40466c3ae0680992f18
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
advapi32
RegCloseKey
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
kernel32
CloseHandle
CopyFileA
CreateDirectoryA
CreateFileA
CreateFileMappingA
CreateMutexA
DosDateTimeToFileTime
ExitProcess
FileTimeToDosDateTime
FileTimeToLocalFileTime
FindClose
FindFirstFileA
FreeLibrary
GetCommandLineA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetFileAttributesA
GetFileSize
GetFileType
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetProcessHeap
GetStdHandle
GetSystemTime
GetTickCount
GetVersionExA
HeapAlloc
HeapFree
HeapReAlloc
LoadLibraryA
LocalAlloc
LocalFileTimeToFileTime
MapViewOfFile
MultiByteToWideChar
RaiseException
ReadFile
ReleaseMutex
RtlUnwind
SetEndOfFile
SetFileAttributesA
SetFilePointer
SetFileTime
Sleep
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
UnmapViewOfFile
VirtualAlloc
VirtualFree
VirtualProtect
WriteFile
oleaut32
SysAllocStringLen
SysFreeString
user32
CharNextA
CreateWindowExA
DefWindowProcA
DispatchMessageA
FindWindowA
FindWindowExA
GetClassNameA
GetDesktopWindow
GetForegroundWindow
GetMessageA
GetParent
GetWindow
GetWindowTextA
IsWindowVisible
MessageBoxA
PeekMessageA
PostMessageA
RegisterClassA
SendMessageA
ShowWindow
TranslateMessage
Sections
.text Size: 54KB - Virtual size: 92KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 22KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE