Static task
static1
Behavioral task
behavioral1
Sample
2112fbe83924eb5d4a370036e9932c7b_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2112fbe83924eb5d4a370036e9932c7b_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
2112fbe83924eb5d4a370036e9932c7b_JaffaCakes118
-
Size
177KB
-
MD5
2112fbe83924eb5d4a370036e9932c7b
-
SHA1
41af9e39bfde12e4ef4e09cd44c0b50fb74fb5e5
-
SHA256
dae51ea0626d14936597ec07b325e8c33772101c7b295a9490d9f5e619b99d24
-
SHA512
0c4fd89897b9aac296cef066bef4276e384538bd95bd53884dd81c249d5f3dba8a07c8d3806f048c6db18aed98336dde1ba3f965985bdfadce4ef52fc3d4ec08
-
SSDEEP
3072:da98j6acact4E1B/sAPhP/oP/vc7jsvIoBfYN/CHPHq:E8nGm0hPAP/p9S/C/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2112fbe83924eb5d4a370036e9932c7b_JaffaCakes118
Files
-
2112fbe83924eb5d4a370036e9932c7b_JaffaCakes118.exe windows:4 windows x86 arch:x86
b5f720642e2c60365eedf7385f7e2bdd
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
OpenMutexA
GetExitCodeProcess
Sleep
TerminateProcess
FindClose
FindFirstFileA
GetCurrentDirectoryA
GetModuleFileNameA
SetEndOfFile
CompareStringW
CompareStringA
GetOEMCP
GetACP
GetCPInfo
FlushFileBuffers
SetStdHandle
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
SetFilePointer
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
CreateMutexA
VirtualFree
HeapCreate
HeapDestroy
GetVersionExA
CreateEventA
WaitForSingleObject
WaitForMultipleObjectsEx
CreateThread
GetCurrentThread
SetEnvironmentVariableA
MulDiv
LocalAlloc
WriteFile
ReadFile
GetFileSize
CreateFileA
ResetEvent
GetCurrentProcess
DuplicateHandle
GetLastError
OutputDebugStringA
SuspendThread
CreateProcessA
ResumeThread
WriteProcessMemory
OpenProcess
GetEnvironmentVariableA
RtlUnwind
HeapSize
CloseHandle
HeapReAlloc
GetVersion
GetCommandLineA
FormatMessageA
VirtualAlloc
LocalFree
ReadProcessMemory
SetCurrentDirectoryA
DeleteFileA
SetFileAttributesA
FindNextFileA
MoveFileA
RemoveDirectoryA
GetProcAddress
FreeLibrary
LoadLibraryA
HeapFree
HeapAlloc
ExitProcess
GetModuleHandleA
GetStartupInfoA
user32
SetForegroundWindow
LoadIconA
LoadCursorA
RegisterClassExA
CreateWindowExA
UpdateWindow
PeekMessageA
TranslateMessage
DispatchMessageA
BeginPaint
EndPaint
DefWindowProcA
GetClientRect
SetWindowTextA
MessageBeep
GetWindowRect
SendMessageTimeoutA
IsWindowVisible
ShowWindow
PostMessageA
BringWindowToTop
AdjustWindowRectEx
IsIconic
SystemParametersInfoA
MoveWindow
MessageBoxA
GetTabbedTextExtentA
GetDC
ReleaseDC
GetDesktopWindow
GetActiveWindow
wsprintfA
GetForegroundWindow
GetWindowThreadProcessId
GetWindowLongA
EnumThreadWindows
EnumWindows
gdi32
GetObjectA
BitBlt
CreateCompatibleDC
DeleteDC
CreateSolidBrush
CreatePen
Rectangle
SetBkMode
LPtoDP
SetTextColor
TextOutA
CreateFontA
SelectObject
DeleteObject
CreateDIBSection
advapi32
CryptAcquireContextA
CryptCreateHash
CryptHashData
CryptImportKey
CryptVerifySignatureA
CryptDestroyKey
CryptDestroyHash
CryptReleaseContext
RegCloseKey
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExA
winmm
timeGetTime
raw_005.wdt
?EnableActivityTracker@@YA_N_N@Z
?IsActivityTrackerEnabled@@YA_NXZ
?ResetActivityCheck@@YAXXZ
?HasBeenActivitySinceLastReset@@YA_NXZ
imagehlp
UnMapAndLoad
MapAndLoad
comctl32
_TrackMouseEvent
Sections
.text Size: 100KB - Virtual size: 98KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 24KB - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 36KB - Virtual size: 33KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.FFF Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE