Static task
static1
Behavioral task
behavioral1
Sample
1a5e9685905ffec6f39913c1332902f8_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
1a5e9685905ffec6f39913c1332902f8_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
1a5e9685905ffec6f39913c1332902f8_JaffaCakes118
-
Size
400KB
-
MD5
1a5e9685905ffec6f39913c1332902f8
-
SHA1
5b4f13e1cfd076f8393c151db37966397c4ee23c
-
SHA256
ebc536a385758e42c79f0760200f3a95a457af35639a1a126a1192d8e8410cdc
-
SHA512
25746a51ab136661933116b1c6a8db3fe2d2a0b0c261e4a3cff7be0374a5d3edf99bc2dd7aadb79ff11c4eba16cba2eaab11b778c940de333976f1102ef95ff8
-
SSDEEP
6144:80/fyyjr1YYE1Ya9kPvprjYWDBMbZeh3TpVezZHx3IC3xtvxZeJ2o8s:fKyvmYE1vmxjBDGbZ2OhOavXeJU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1a5e9685905ffec6f39913c1332902f8_JaffaCakes118
Files
-
1a5e9685905ffec6f39913c1332902f8_JaffaCakes118.exe windows:5 windows x86 arch:x86
5d9d156673432c7f52cb3a8f0138a85c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
gdi32
DeviceCapabilitiesExA
GdiConvertRegion
GetPath
EnumMetaFile
CreateFontA
kernel32
GetModuleHandleA
SetUnhandledExceptionFilter
SizeofResource
GetStartupInfoA
SetConsoleTitleA
GetDiskFreeSpaceA
TryEnterCriticalSection
VirtualProtect
IsBadWritePtr
GetCommandLineA
DelayLoadFailureHook
SearchPathW
GetBinaryTypeA
CreateToolhelp32Snapshot
GetNextVDMCommand
VerLanguageNameA
GetEnvironmentVariableA
advapi32
SetEntriesInAccessListA
SystemFunction032
RegQueryValueExA
ElfRegisterEventSourceW
OpenSCManagerA
DuplicateEncryptionInfoFile
ImpersonateNamedPipeClient
RegCreateKeyExW
AccessCheckByTypeResultListAndAuditAlarmByHandleW
user32
SetRectEmpty
MenuItemFromPoint
CharPrevW
PackDDElParam
DdeConnectList
DdeGetQualityOfService
SetWindowsHookExA
ChangeMenuW
msvcrt
__p__timezone
_ismbstrail
_mbsstr
mbstowcs
_abnormal_termination
iswalnum
_ismbclegal
strcoll
_mbsnbcmp
_mbsupr
Sections
.text Size: 396KB - Virtual size: 396KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 569KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 828B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ