Static task
static1
Behavioral task
behavioral1
Sample
0dd2e2da8fcd6ecb78ecb4123a4d8072_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
0dd2e2da8fcd6ecb78ecb4123a4d8072_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
0dd2e2da8fcd6ecb78ecb4123a4d8072_JaffaCakes118
-
Size
150KB
-
MD5
0dd2e2da8fcd6ecb78ecb4123a4d8072
-
SHA1
072a422b3e9da91e2386905dfe3dbc9f0a723b23
-
SHA256
9246861e0c1f4e0cf7d62825cd081059638c366e5dab00b5aa3a85223c17c391
-
SHA512
2e4b8f2f6f75bd5230b2d3fb87884367468402b99a1bcb1680c9fd1e3ee0181ecf2183aab1e294e818a41eff956baf4dff01ff649d07d87f159888f8a99b7ed1
-
SSDEEP
3072:gdSLTJEGAN9nWHdv7PX38YOuA2dy9Q37R9UV8z1muG:rmKfeuACr7R9UV8z13G
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0dd2e2da8fcd6ecb78ecb4123a4d8072_JaffaCakes118
Files
-
0dd2e2da8fcd6ecb78ecb4123a4d8072_JaffaCakes118.exe windows:4 windows x86 arch:x86
2e930f2a38d59852b6ead5eebba4a6de
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
InterlockedIncrement
SetErrorMode
GetStringTypeA
DeleteFileA
GetShortPathNameA
GlobalFree
GetSystemDirectoryW
GetModuleHandleA
VirtualFree
VirtualProtect
CreateFileMappingA
GetStartupInfoA
SetFileAttributesW
GetModuleFileNameW
GetDiskFreeSpaceA
GetEnvironmentVariableA
user32
EqualRect
CloseClipboard
SetTimer
GetScrollPos
UpdateWindow
DrawIcon
WindowFromPoint
GetSysColor
GetWindowThreadProcessId
RemovePropA
msvcrt
log10
isspace
__p__commode
iswdigit
puts
wcschr
_getch
__setusermatherr
_XcptFilter
_acmdln
__getmainargs
wcscmp
__CxxFrameHandler
_adjust_fdiv
__p__fmode
__set_app_type
exit
_except_handler3
_initterm
advapi32
RegDeleteKeyW
RegSetValueExW
RegFlushKey
RegDeleteValueW
InitiateSystemShutdownA
FreeSid
OpenSCManagerA
RegEnumKeyW
RegQueryInfoKeyW
ole32
CoTaskMemRealloc
CoGetInterfaceAndReleaseStream
DoDragDrop
StringFromIID
StgOpenStorage
OleFlushClipboard
CoRevokeClassObject
CoInitialize
StringFromGUID2
CoCreateGuid
shell32
ShellExecuteEx
DragQueryFile
ShellExecuteA
SHGetFileInfo
SHGetFileInfoA
SHGetPathFromIDListA
SHBrowseForFolderA
SHBrowseForFolder
comctl32
ImageList_LoadImageW
PropertySheetW
ImageList_SetImageCount
CreatePropertySheetPageA
oleaut32
VariantCopyInd
SafeArrayPutElement
VariantCopy
SafeArrayCreate
VariantInit
SysReAllocStringLen
Sections
.text Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 138KB - Virtual size: 138KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE