Static task
static1
Behavioral task
behavioral1
Sample
bl.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
bl.exe
Resource
win10v2004-20240508-en
General
-
Target
18636e50edeb2644c08a9e952e5aaf4d_JaffaCakes118
-
Size
60KB
-
MD5
18636e50edeb2644c08a9e952e5aaf4d
-
SHA1
8e06502cd4d1277c73c03f1d715c01c767cf30eb
-
SHA256
1d6efec5c5971ade5f3f871f9e993269bda92fbe8a713c2f504e206d7a29d3a2
-
SHA512
ff778f4d2291f200d44fa7fd4e4569989fab54e02a67a2348fb2f314a5c24de2b7fff7db0d9afba6c744c29638673fb97e3ca7612f0a87a6aa96723c429a18f9
-
SSDEEP
768:5p/wxJO5HQe2OU6/7Rgb5Qypn+EjOHuJ/bqeTEJL9DHAj8LCEJenq5Oqh9PWoqc2:v/1Q9Qmb5QnMogRybCQhpEcmp1GJjB2j
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/bl.exe
Files
-
18636e50edeb2644c08a9e952e5aaf4d_JaffaCakes118.zip
-
b.txt
-
bl.exe.exe windows:4 windows x86 arch:x86
c4e415dc20169c8bc984bc9acaf759d7
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleA
ExitProcess
GetWindowsDirectoryA
lstrcatA
CreateDirectoryA
DeleteFileA
RemoveDirectoryA
FindResourceA
LoadResource
LockResource
SizeofResource
CreateFileA
WriteFile
CloseHandle
OpenProcess
VirtualAllocEx
WriteProcessMemory
LoadLibraryA
GetProcAddress
CreateRemoteThread
user32
DialogBoxParamA
SetTimer
LoadBitmapA
SendDlgItemMessageA
EndDialog
FindWindowA
GetWindowThreadProcessId
GetDlgItem
SendMessageA
RegisterHotKey
ReleaseCapture
gdi32
CreateFontA
SetBkMode
SetTextColor
SetBkColor
CreateSolidBrush
GetStockObject
Sections
code Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
data Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 365KB - Virtual size: 364KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ