Static task
static1
Behavioral task
behavioral1
Sample
158c3893a73824f2f5e63e25c99fa7ad_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
158c3893a73824f2f5e63e25c99fa7ad_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
158c3893a73824f2f5e63e25c99fa7ad_JaffaCakes118
-
Size
115KB
-
MD5
158c3893a73824f2f5e63e25c99fa7ad
-
SHA1
0b6acbf90a0eb61c0940629def9849f46209a2b7
-
SHA256
91fab6fbd0e0d894c66de6512fd47f5361da157f8c8e48f4a98569980824ef36
-
SHA512
9c6b1f926a1f2bff9a8be80497136c0ebefb9be0cf71a85e159d28e7dd3788c7641d99f830977f6fa2fe714585099bf719c1f382798f170ba5dc2a5256455538
-
SSDEEP
3072:VwUeOVnUFEckGZTMvFvAyBDON/+nGKr3P12Gy:T1YVklvFvDBDONaPAG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 158c3893a73824f2f5e63e25c99fa7ad_JaffaCakes118
Files
-
158c3893a73824f2f5e63e25c99fa7ad_JaffaCakes118.exe windows:4 windows x86 arch:x86
786c270f9bf875c3346c75a1ea619a6b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
gdi32
InvertRgn
PolyPatBlt
RectVisible
CreateRectRgn
msvcrt
_copysign
__p__tzname
__p__wpgmptr
_mbsnicmp
_dup
_getws
_inp
kernel32
CreateEventW
GetCommConfig
GetCurrentProcessId
GetThreadLocale
LocalAlloc
LocalHandle
Sections
.text Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 91KB - Virtual size: 117KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.oooo Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE