Static task
static1
Behavioral task
behavioral1
Sample
2261f8973de98e23a080655d17647785_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2261f8973de98e23a080655d17647785_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
2261f8973de98e23a080655d17647785_JaffaCakes118
-
Size
100KB
-
MD5
2261f8973de98e23a080655d17647785
-
SHA1
cf4c1d573a89f24b8ea565978414fd3d70bd570a
-
SHA256
f4651d0a2b9c7643e361a7c416941ce74b58dc24935c8e58447c801e9c4982df
-
SHA512
026a87bb650f770c7e740b95e0d56c7277db6246e07f32fe1c228cf0b83967b4a69b4e824a3ef002b6d030887ffb09bcad7b4089e80e8e921c7f0a69c41e407c
-
SSDEEP
1536:NWeAVOa2H88/g3iPo3C9+O8fMAXytt4k2Ok+0qK8kB9zZU8gtbfaUcIoC7:MeM2HT/gyP56MAXyck5r0qKNRqraZC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2261f8973de98e23a080655d17647785_JaffaCakes118
Files
-
2261f8973de98e23a080655d17647785_JaffaCakes118.exe windows:5 windows x86 arch:x86
87f84a125cdd7cd9ee1cacd8d1f79cb6
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
user32
GetParent
GetDC
GetSystemMetrics
GetDesktopWindow
TranslateMessage
CharNextA
gdi32
SetMapMode
SelectPalette
LineTo
SaveDC
GetPixel
GetNearestPaletteIndex
GetClipBox
RestoreDC
CreateCompatibleDC
SetTextColor
SetTextAlign
CreateSolidBrush
DeleteObject
RectVisible
GetDeviceCaps
GetTextMetricsA
PatBlt
DeleteDC
SelectObject
GetStockObject
CreatePalette
GetObjectA
CreateFontIndirectA
SetStretchBltMode
CreatePen
kernel32
SetCurrentDirectoryA
RemoveDirectoryW
GetModuleHandleA
GetCommandLineA
lstrcmpA
lstrlenW
GetVersion
lstrcmpiW
lstrcmpiA
GetThreadLocale
GetModuleHandleW
GetConsoleOutputCP
GetCurrentThread
GetACP
GetProcessHeap
GetCurrentProcessId
lstrlenA
GlobalFindAtomA
GlobalFindAtomW
GetWindowsDirectoryA
GetOEMCP
ExitProcess
DeleteFileA
GetUserDefaultLangID
MulDiv
GetTickCount
GetStartupInfoA
GetCurrentThreadId
DeleteFileW
GetDriveTypeA
VirtualAlloc
QueryPerformanceCounter
RemoveDirectoryA
VirtualFree
CopyFileA
GetCommandLineW
IsDebuggerPresent
GetCurrentProcess
glu32
gluQuadricCallback
Sections
.text Size: 22KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 65KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ