Static task
static1
Behavioral task
behavioral1
Sample
16a1f74bd763ba694d323e75c678b101_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
16a1f74bd763ba694d323e75c678b101_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
16a1f74bd763ba694d323e75c678b101_JaffaCakes118
-
Size
370KB
-
MD5
16a1f74bd763ba694d323e75c678b101
-
SHA1
f2e5dbe3dddd413282ee33c0bb9571d36ee6b61f
-
SHA256
86889dad3a30d98ef9640c6dfb98647a35d5ffa1362294019946b42eb074f754
-
SHA512
a5fb0512f51d644fbf9d718f0e31a45ef0d0d4a25518e650b1c08586c2339c3816dc177f5eab714e9bbfc9180d473fa229553152ae6ba5bbe2f9e187b55c6019
-
SSDEEP
6144:llBVZUFcvRR0sM1E6B3nhZsHZrTQ0VGHLXGpLMnOjri8VjNvgLSTqiJISTJxg:lJZUF1J9Hs90GGLGpLMOjVNYL2njo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 16a1f74bd763ba694d323e75c678b101_JaffaCakes118
Files
-
16a1f74bd763ba694d323e75c678b101_JaffaCakes118.exe windows:4 windows x86 arch:x86
59c99b6e9642b2335acee61319b64331
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
gdi32
GetTextCharacterExtra
GetCharWidthA
SetDIBits
GdiPlayJournal
Polygon
PolyTextOutA
GetTextExtentPoint32A
SetMapperFlags
GetWindowOrgEx
GetTextMetricsA
CreateDIBPatternBrush
CopyEnhMetaFileA
CreateFontIndirectW
Ellipse
PlayMetaFileRecord
CreatePolygonRgn
SetWindowOrgEx
StartPage
SetAbortProc
OffsetViewportOrgEx
ExtTextOutA
SelectPalette
CreateEnhMetaFileW
SetMetaFileBitsEx
wininet
FtpCommandW
HttpQueryInfoW
InternetOpenA
InternetFortezzaCommand
ShowCertificate
InternetAlgIdToStringA
InternetCrackUrlW
SetUrlCacheHeaderData
GetUrlCacheEntryInfoExW
InternetFindNextFileA
FtpPutFileA
InternetFindNextFileW
InternetSetDialStateW
HttpOpenRequestA
FtpGetFileW
FindNextUrlCacheEntryW
InternetGetConnectedStateEx
InternetTimeFromSystemTime
InternetReadFile
HttpSendRequestExW
InternetCheckConnectionW
InternetReadFileExA
FtpDeleteFileW
InternetGoOnlineA
CreateUrlCacheEntryW
comdlg32
GetOpenFileNameA
PrintDlgA
ReplaceTextW
GetFileTitleW
GetOpenFileNameW
PageSetupDlgW
ReplaceTextA
user32
SetForegroundWindow
WindowFromPoint
DefDlgProcA
ReleaseCapture
GetCursorPos
EnumWindowStationsW
SendIMEMessageExA
EnumThreadWindows
kernel32
InterlockedExchange
GetCurrentThreadId
QueryPerformanceCounter
VirtualQuery
VirtualProtectEx
TerminateProcess
HeapFree
GetProcAddress
ExitProcess
RtlUnwind
VirtualAlloc
CreateSemaphoreA
GetModuleFileNameA
RtlZeroMemory
LoadLibraryA
ResetEvent
GetSystemTimeAsFileTime
HeapReAlloc
EnumResourceNamesA
GetModuleHandleA
PulseEvent
GetCurrentProcessId
CopyFileA
GetDiskFreeSpaceExW
GetTickCount
GetCurrentProcess
HeapAlloc
advapi32
CryptExportKey
RegRestoreKeyW
CryptSetProviderExW
RegQueryValueExW
Sections
.text Size: 104KB - Virtual size: 103KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 263KB - Virtual size: 262KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ