Static task
static1
Behavioral task
behavioral1
Sample
1b2fca5d46215e0def66b5b556da7359_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
1b2fca5d46215e0def66b5b556da7359_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
1b2fca5d46215e0def66b5b556da7359_JaffaCakes118
-
Size
114KB
-
MD5
1b2fca5d46215e0def66b5b556da7359
-
SHA1
8240cf4cc822c0f09e29c8ff2dd62530491b31ce
-
SHA256
caa4b1a77774b41c33d359dd053b362162c918d28ade7e63ecd4e8792a8ceb9b
-
SHA512
47069d1a2419255fa10a293f2f890cd6030fb0a57cf79baf465c226963a8c861dbde27293c8629c50aac32a176bf33a632aab7439ff6fe4dfea115bcce0fdefd
-
SSDEEP
1536:/PoiUYdq1kDPpfo18SYSEBTrXoChYs2unEDxgWskivll7sfFM:IiPd/M8lnVr4kYs2zDxgpki9OfFM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1b2fca5d46215e0def66b5b556da7359_JaffaCakes118
Files
-
1b2fca5d46215e0def66b5b556da7359_JaffaCakes118.exe windows:5 windows x86 arch:x86
ab843fb4cf14e195900cedc3a6eb7644
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
gdi32
CreateSolidBrush
LineTo
DeleteObject
GetDeviceCaps
DeleteDC
SelectObject
SetMapMode
GetPixel
CreatePalette
SetStretchBltMode
GetObjectA
CreatePen
PatBlt
SetTextColor
SetTextAlign
CreateCompatibleDC
GetStockObject
SaveDC
CreateFontIndirectA
GetTextMetricsA
RectVisible
SetPixel
GetClipBox
RestoreDC
SelectPalette
kernel32
lstrcmpiW
GetModuleHandleA
GetStartupInfoA
lstrlenW
GetCurrentProcessId
GetProcessHeap
GetVersion
GetWindowsDirectoryA
DeleteFileA
GetOEMCP
GetThreadLocale
RemoveDirectoryA
GetCommandLineW
GetACP
GlobalFindAtomA
lstrlenA
IsDebuggerPresent
lstrcmpA
GlobalFindAtomW
DeleteFileW
GetTickCount
GetUserDefaultLangID
GetModuleHandleW
RemoveDirectoryW
SetCurrentDirectoryA
GetCurrentThreadId
GetDriveTypeA
GetCurrentThread
GetCommandLineA
GetCurrentProcess
GetConsoleOutputCP
MulDiv
QueryPerformanceCounter
CopyFileA
lstrcmpiA
VirtualAlloc
VirtualFree
user32
GetParent
TranslateMessage
GetSystemMetrics
CharNextA
GetDesktopWindow
glu32
gluQuadricCallback
Sections
.text Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 80KB - Virtual size: 79KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ