Static task
static1
Behavioral task
behavioral1
Sample
1b6ed9d26e624fe097f61ec665f11422_JaffaCakes118.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
1b6ed9d26e624fe097f61ec665f11422_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
1b6ed9d26e624fe097f61ec665f11422_JaffaCakes118
-
Size
164KB
-
MD5
1b6ed9d26e624fe097f61ec665f11422
-
SHA1
4627b005265179b50cb82a1d79359608f9800177
-
SHA256
cf3bcdc851dc9b0e26d5d1900087a1cdaee0d107a9f196a629d2c65d3dc1dd32
-
SHA512
99f4532478715c32a94aa57d5a8ac9a686eaac148d641f601cf7f73745f1df4a3e71a53ee4e222052f4eccb78144341a27e0444439d26bf3f1698dd1d3af674f
-
SSDEEP
3072:dsFmRxU1Y5F8iGVraW7n+SFVsi05S3SF8bU:dsFmxJ0Rn+S98xt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1b6ed9d26e624fe097f61ec665f11422_JaffaCakes118
Files
-
1b6ed9d26e624fe097f61ec665f11422_JaffaCakes118.exe windows:5 windows x86 arch:x86
fec1dedcf045fe2a621c02c2e5f641bc
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CopyFileA
GetVersion
GetProcessHeap
DeleteFileA
GetCurrentThread
lstrlenW
MulDiv
GlobalFindAtomA
GetUserDefaultLangID
lstrcmpiA
GetConsoleOutputCP
QueryPerformanceCounter
RemoveDirectoryA
GetModuleHandleW
GlobalFindAtomW
GetOEMCP
IsDebuggerPresent
GetDriveTypeA
GetCommandLineW
GetTickCount
GetCurrentProcessId
lstrcmpiW
GetCurrentProcess
lstrlenA
GetModuleHandleA
GetCurrentThreadId
GetWindowsDirectoryA
DeleteFileW
SetCurrentDirectoryA
GetCommandLineA
GetACP
lstrcmpA
VirtualAlloc
VirtualFree
GetThreadLocale
gdi32
DeleteObject
LineTo
CreateCompatibleDC
SetTextColor
SelectObject
CreateFontIndirectA
CreatePen
CreatePalette
GetDeviceCaps
GetObjectA
SetTextAlign
GetTextMetricsA
SelectPalette
PatBlt
RectVisible
GetPixel
SetStretchBltMode
SetMapMode
GetStockObject
GetClipBox
RestoreDC
DeleteDC
SaveDC
user32
GetParent
TranslateMessage
GetDC
GetDesktopWindow
CharNextA
GetSystemMetrics
glu32
gluNurbsCallback
Sections
.text Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Gurmx Yu Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Sexyy. S Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 98KB - Virtual size: 98KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ