Static task
static1
Behavioral task
behavioral1
Sample
1961f50f55f656755a08f140666b5d67_JaffaCakes118.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
1961f50f55f656755a08f140666b5d67_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
1961f50f55f656755a08f140666b5d67_JaffaCakes118
-
Size
168KB
-
MD5
1961f50f55f656755a08f140666b5d67
-
SHA1
5b9eb2ae6d5fed66ca39250d5039883535fde7b9
-
SHA256
c253471575d8f1c0c57399141332398106e41f69684a13256b6ed5a42e5554c9
-
SHA512
c4fb2f618ee1a0858b8a0dff6b5c9b210c5d3002fc03bc074a86f77cb450c84b2e3f6f0e02ce1ca151189f6613f7ced878ef7d707af758475f3bc160ead6ab2b
-
SSDEEP
3072:zT5An0kjNrNQ7iAP02ppyMZ9c77MAFZuMsXmRYYBG:zWjYZ02ppyR7pFZwWW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1961f50f55f656755a08f140666b5d67_JaffaCakes118
Files
-
1961f50f55f656755a08f140666b5d67_JaffaCakes118.exe windows:5 windows x86 arch:x86
2a60236e62e792892f3cec32a9b66da4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
QueryPerformanceCounter
GetStartupInfoA
GetCurrentThread
lstrcmpA
GetACP
CopyFileA
lstrcmpiW
GetCommandLineW
GetThreadLocale
GetCurrentProcess
GetConsoleOutputCP
GetProcessHeap
GetVersion
GetOEMCP
lstrcmpiA
GlobalFindAtomW
GetCurrentProcessId
DeleteFileA
DeleteFileW
GetDriveTypeA
VirtualAlloc
GetTickCount
VirtualFree
IsDebuggerPresent
GetModuleHandleA
MulDiv
SetCurrentDirectoryA
GlobalFindAtomA
GetCurrentThreadId
GetUserDefaultLangID
GetModuleHandleW
lstrlenA
GetCommandLineA
lstrlenW
RemoveDirectoryA
GetWindowsDirectoryA
gdi32
PatBlt
SaveDC
DeleteDC
SetMapMode
SetStretchBltMode
CreateCompatibleDC
GetClipBox
RestoreDC
CreatePen
CreateSolidBrush
LineTo
GetStockObject
SelectPalette
GetTextMetricsA
GetDeviceCaps
SelectObject
CreateFontIndirectA
SetTextAlign
GetPixel
RectVisible
SetTextColor
CreatePalette
DeleteObject
GetObjectA
user32
TranslateMessage
GetDesktopWindow
CharNextA
GetSystemMetrics
GetParent
GetDC
glu32
gluNurbsCallback
Sections
.text Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Wtxge. T Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Rwfx. Hu Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 101KB - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ