Static task
static1
Behavioral task
behavioral1
Sample
1ab97abf82ab432f2e2e1aace9d7ff78_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
1ab97abf82ab432f2e2e1aace9d7ff78_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
1ab97abf82ab432f2e2e1aace9d7ff78_JaffaCakes118
-
Size
326KB
-
MD5
1ab97abf82ab432f2e2e1aace9d7ff78
-
SHA1
72f3fcaef0b961d1feefcc30de46f5b0c502bcca
-
SHA256
36c5ddcfd11626f82eb28f7067c10971d375e2319c53d2ff81c38eddb93d81ec
-
SHA512
6ca7d4bdc0fc21cdb013193f879610075d43a2cd56c0c6304e08e535aa2cd68177400145ad5b90edebb4bca018171e18148b651002d55c63fb54a653edc5e128
-
SSDEEP
6144:ne/qLHz//Z9MaDJckOqFd++rCDOzHk//Z9:nO+bPMc1OP+eDQaP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1ab97abf82ab432f2e2e1aace9d7ff78_JaffaCakes118
Files
-
1ab97abf82ab432f2e2e1aace9d7ff78_JaffaCakes118.exe windows:4 windows x86 arch:x86
8bbdf8daf1d828160aff658557e26dae
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
memset
strncpy
strlen
strcpy
strcat
memcmp
_stricmp
memcpy
fclose
fopen
fseek
sprintf
strcmp
strncmp
memmove
kernel32
GetModuleHandleA
HeapCreate
CreateMutexA
GetLastError
CloseHandle
GlobalAddAtomA
HeapDestroy
ExitProcess
CreateToolhelp32Snapshot
Process32First
Process32Next
GetCurrentProcess
GetProcAddress
VirtualFreeEx
WaitForSingleObject
HeapFree
HeapAlloc
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
GetVersionExA
LoadLibraryA
DeleteCriticalSection
CreateThread
Sleep
GetCurrentThreadId
GetCurrentProcessId
GetModuleFileNameA
CreateFileA
SetFilePointer
SetEndOfFile
WriteFile
GetFileSize
ReadFile
GetTickCount
FreeLibrary
GlobalAlloc
GlobalFree
CreateDirectoryA
GetDriveTypeA
FindFirstFileA
FindClose
GetFileAttributesA
DeleteFileA
FindNextFileA
WaitForMultipleObjects
HeapReAlloc
ResetEvent
SetEvent
TlsGetValue
TlsSetValue
GetCurrentThread
DuplicateHandle
TlsAlloc
CreateEventA
comctl32
InitCommonControls
InitCommonControlsEx
user32
RegisterHotKey
FindWindowA
GetParent
GetWindowThreadProcessId
GetWindowTextA
GetWindow
ShowWindowAsync
EnableWindow
DefWindowProcA
DestroyWindow
GetWindowLongA
GetWindowTextLengthA
UnregisterClassA
LoadCursorA
RegisterClassExA
IsWindowEnabled
GetSystemMetrics
CreateWindowExA
SetWindowLongA
SendMessageA
SetFocus
CreateAcceleratorTableA
SetForegroundWindow
BringWindowToTop
GetMessageA
TranslateAcceleratorA
TranslateMessage
DispatchMessageA
DestroyAcceleratorTable
MessageBoxA
IsWindowVisible
GetForegroundWindow
EnumWindows
SetMenu
DestroyMenu
GetMenuItemInfoA
SetMenuItemInfoA
GetCursorPos
ModifyMenuA
CreatePopupMenu
AppendMenuA
TrackPopupMenu
DestroyIcon
CreateIconFromResourceEx
CreateIconFromResource
GetIconInfo
SetWindowTextA
GetSysColor
GetSysColorBrush
CallWindowProcA
RemovePropA
SetPropA
GetPropA
RedrawWindow
SetActiveWindow
LoadIconA
PeekMessageA
MsgWaitForMultipleObjects
GetActiveWindow
RegisterClassA
AdjustWindowRect
GetWindowRect
ShowWindow
IsZoomed
IsIconic
SetCursorPos
LoadImageA
SetCursor
MapWindowPoints
MoveWindow
SystemParametersInfoA
GetKeyState
SetCapture
PostMessageA
ReleaseCapture
GetFocus
IsChild
GetClassNameA
EnumChildWindows
GetClientRect
FillRect
DefFrameProcA
gdi32
GetStockObject
GetObjectType
DeleteObject
CreateCompatibleDC
SetDIBits
DeleteDC
GetObjectA
CreateDCA
CreateCompatibleBitmap
CreateDIBSection
SetBkColor
SetTextColor
CreateSolidBrush
shell32
Shell_NotifyIconA
ole32
CoInitialize
RevokeDragDrop
Sections
.code Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 324B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 213KB - Virtual size: 214KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 81KB - Virtual size: 81KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ