Static task
static1
Behavioral task
behavioral1
Sample
0ed7d6b95d7cd191c0ebb581ee8a7e8c_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
0ed7d6b95d7cd191c0ebb581ee8a7e8c_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
0ed7d6b95d7cd191c0ebb581ee8a7e8c_JaffaCakes118
-
Size
103KB
-
MD5
0ed7d6b95d7cd191c0ebb581ee8a7e8c
-
SHA1
f808d0d3f80dd15232723aabae01ab022d59281d
-
SHA256
1b9fd13c6b0b0b53b5893bf89e3160e7d40e157547a0c0ea03ff1c84e0b9d5a2
-
SHA512
03fd2b6d8c0714e5d63791b98a2a8b91334441adad3addd9e97113bfdb1c93e062b5e9e7ad89bca2d0dfbc4a764de2346b7e702c45401ece1e57dad41751e1eb
-
SSDEEP
1536:d9KS9mAjWtODFCbDlcctMGxjPpseD1EaUySz8CWS4MIw3i6Oq+UMNoQjv:d1hjWIxuJxjPpvDP6BLJjMNoQj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0ed7d6b95d7cd191c0ebb581ee8a7e8c_JaffaCakes118
Files
-
0ed7d6b95d7cd191c0ebb581ee8a7e8c_JaffaCakes118.exe windows:5 windows x86 arch:x86
db418c13d61da6a8e95e4d8ec424cd8a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
gdi32
GetTextMetricsA
SetMapMode
RestoreDC
CreateSolidBrush
SetTextColor
GetDeviceCaps
SelectPalette
GetStockObject
CreateCompatibleDC
GetClipBox
DeleteObject
RectVisible
SetStretchBltMode
DeleteDC
SaveDC
GetObjectA
CreateFontIndirectA
CreatePalette
SelectObject
LineTo
SetTextAlign
GetPixel
user32
GetDC
GetParent
CharNextA
TranslateMessage
GetSystemMetrics
GetDesktopWindow
kernel32
lstrcmpA
GetCommandLineA
lstrlenA
CopyFileA
RemoveDirectoryW
FindClose
GetWindowsDirectoryA
lstrcmpiA
GetSystemTime
DeleteFileA
GetModuleHandleA
QueryPerformanceCounter
VirtualAlloc
lstrlenW
VirtualFree
GlobalFindAtomA
RemoveDirectoryA
glu32
gluNurbsCallback
Sections
.text Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 47KB - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ