Static task
static1
Behavioral task
behavioral1
Sample
2957402624cd73d92f1dbd5732c82e8b_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2957402624cd73d92f1dbd5732c82e8b_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
2957402624cd73d92f1dbd5732c82e8b_JaffaCakes118
-
Size
429KB
-
MD5
2957402624cd73d92f1dbd5732c82e8b
-
SHA1
46c8a76e679a254509f5ea182b48e6fd414ea0c3
-
SHA256
d66930d79207514cac334029fb1045cc22794f16f18120a5f2a5d190f3196e20
-
SHA512
6a4ee5f59e032a2c9563030eabd537227b25a54484ce7363b68711b3ecdc78e5cabb6c1c278b72257e3fc5401db911562408bbb21117b9b2ce705ef597a6ef61
-
SSDEEP
6144:HLo5an7P/0RKV93DC7ijmomrJ2JPpdGdsxnpGHz6EdRJv1pilEUbQKb:H3rlZDUijmocJsquQH/vHOz0K
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2957402624cd73d92f1dbd5732c82e8b_JaffaCakes118
Files
-
2957402624cd73d92f1dbd5732c82e8b_JaffaCakes118.exe windows:4 windows x86 arch:x86
fa9859118df06e158e05e25bb0551bfe
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
comdlg32
ChooseFontW
GetSaveFileNameA
ChooseFontA
PageSetupDlgA
ReplaceTextW
PrintDlgA
ReplaceTextA
FindTextW
LoadAlterBitmap
GetOpenFileNameA
FindTextA
advapi32
RegCreateKeyW
CryptGetDefaultProviderA
RegQueryInfoKeyA
RegSetKeySecurity
RegEnumKeyW
CryptReleaseContext
ReportEventW
CryptSetProvParam
RegCreateKeyExW
RegEnumValueA
LogonUserA
CreateServiceW
InitiateSystemShutdownW
RegDeleteKeyW
RegReplaceKeyA
RegSetValueExA
RegCloseKey
RegDeleteValueW
RegOpenKeyExW
CryptGenRandom
RegQueryInfoKeyW
LookupAccountSidA
CryptAcquireContextA
wininet
InternetCreateUrlW
CommitUrlCacheEntryW
FindFirstUrlCacheContainerA
InternetCrackUrlA
InternetSetOptionExA
gdi32
GetFontData
SetLayout
GetFontLanguageInfo
GetTextExtentPointA
AddFontResourceA
UpdateICMRegKeyA
CreateColorSpaceA
GetEnhMetaFileA
AbortDoc
SetBkColor
SetBoundsRect
GetStretchBltMode
ArcTo
SetEnhMetaFileBits
SetTextCharacterExtra
kernel32
ExitProcess
HeapReAlloc
GetModuleFileNameA
GetTickCount
RtlUnwind
UnhandledExceptionFilter
WideCharToMultiByte
GetTimeZoneInformation
HeapSize
TlsAlloc
GetModuleHandleW
TlsFree
QueryPerformanceCounter
IsDebuggerPresent
CreateThread
GetSystemTimeAsFileTime
HeapDestroy
GetLocaleInfoW
GetACP
Sleep
InterlockedDecrement
DeleteFiber
GetDateFormatA
GetCurrentProcessId
GetCurrentThread
FreeLibrary
LeaveCriticalSection
WriteFile
GetUserDefaultLCID
InterlockedIncrement
LoadLibraryA
GetOEMCP
TlsGetValue
VirtualFree
LCMapStringA
EnterCriticalSection
GetModuleHandleA
GetStartupInfoW
GetTimeFormatA
GetModuleFileNameW
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
SetConsoleCtrlHandler
GetVolumeInformationA
SetHandleCount
GetCPInfo
GetLocaleInfoA
VirtualAlloc
InterlockedExchange
GetLogicalDriveStringsW
WriteFileEx
HeapFree
HeapAlloc
LCMapStringW
GetDateFormatW
GetStartupInfoA
CompareStringW
IsValidLocale
TerminateProcess
GetStdHandle
EnumSystemLocalesA
VirtualQuery
GetLastError
GetCommandLineW
GetProcAddress
GetFileType
SetConsoleTitleW
SetUnhandledExceptionFilter
IsValidCodePage
GetStringTypeA
TlsSetValue
GetStringTypeW
SetEnvironmentVariableA
FreeEnvironmentStringsW
MultiByteToWideChar
SetLastError
HeapCreate
SetConsoleCursorPosition
GetEnvironmentStringsW
CompareStringA
GetCurrentProcess
GetCurrentThreadId
shell32
ShellExecuteEx
DragQueryFileAorW
SHEmptyRecycleBinA
SHFileOperationW
DragQueryFile
ExtractIconW
ExtractIconA
CheckEscapesW
SHGetDataFromIDListW
RealShellExecuteExA
ExtractAssociatedIconA
SHGetFileInfoA
SHBrowseForFolderW
SHGetFileInfo
SHGetDiskFreeSpaceA
DragFinish
SHGetPathFromIDListA
SHAddToRecentDocs
Sections
.text Size: 144KB - Virtual size: 144KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 274KB - Virtual size: 288KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ