Static task
static1
Behavioral task
behavioral1
Sample
29ecbc4053e619f0091f21a6f7edda1f_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
29ecbc4053e619f0091f21a6f7edda1f_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
29ecbc4053e619f0091f21a6f7edda1f_JaffaCakes118
-
Size
628KB
-
MD5
29ecbc4053e619f0091f21a6f7edda1f
-
SHA1
362f89c013bff675bc8eabae215f3321f9349b64
-
SHA256
d896fe1d3b86c6a6f00ac4c8fa79aefc45fdee3b0fac3d1c4036bb9e95f59f3b
-
SHA512
57e1bd8450289e0fe9f360c08e21993727b217b65f67c74bd278e6a53d9b7eb5cddf17967bf60daac98e223b77ef5177de140b0f8b3a161bef455c18dc0a654d
-
SSDEEP
12288:ZVbS32DsMBMKlz9ZhXzVe57rwib7GKqKtDe603uzffTEox:Zy2Dsw7lz9XzwFECqMS60Yoox
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 29ecbc4053e619f0091f21a6f7edda1f_JaffaCakes118
Files
-
29ecbc4053e619f0091f21a6f7edda1f_JaffaCakes118.exe windows:4 windows x86 arch:x86
953cd67318bb074c6efaddca469df59a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
comctl32
InitCommonControlsEx
CreateStatusWindowA
GetEffectiveClientRect
CreatePropertySheetPageA
comdlg32
ReplaceTextW
user32
DispatchMessageW
GetQueueStatus
FlashWindowEx
CharPrevW
RegisterClassExA
IsCharLowerA
IsCharAlphaNumericA
IsChild
MapDialogRect
EnableMenuItem
GetMenuItemInfoA
DestroyWindow
MessageBoxExW
UnregisterHotKey
EnumDisplayMonitors
DefWindowProcA
DrawFrameControl
CreateWindowExA
ScrollWindowEx
SendMessageW
SetMenuItemInfoW
CreateDialogParamW
CharUpperA
LoadKeyboardLayoutA
SetFocus
MessageBoxW
ShowWindow
RegisterClassA
gdi32
CloseEnhMetaFile
CreateDCA
PlayEnhMetaFileRecord
SetICMMode
CreatePalette
CreateMetaFileA
Ellipse
CreateICW
TranslateCharsetInfo
kernel32
VirtualAlloc
GetEnvironmentStrings
ReadFileEx
SuspendThread
FlushFileBuffers
GlobalCompact
GetProcAddress
GetVersionExA
EnumSystemCodePagesA
lstrcatA
DeleteCriticalSection
IsBadWritePtr
SetLastError
ExitProcess
FreeEnvironmentStringsW
GetCPInfo
HeapDestroy
GetCommandLineW
ResetEvent
SetConsoleCtrlHandler
GetStringTypeW
TlsFree
VirtualFree
InterlockedDecrement
SetEnvironmentVariableA
MultiByteToWideChar
GetSystemInfo
GetStringTypeA
GetUserDefaultLCID
GetLocaleInfoW
GetACP
CreateWaitableTimerW
DebugActiveProcess
TlsGetValue
GetCommandLineA
HeapSize
GetSystemTimeAsFileTime
GetVolumeInformationW
FileTimeToLocalFileTime
SetConsoleCursorPosition
GlobalSize
GetTimeFormatA
GetStartupInfoW
GetCompressedFileSizeW
HeapReAlloc
GetLongPathNameA
GetModuleFileNameA
InterlockedExchange
WaitForSingleObject
SetEndOfFile
EnumDateFormatsA
GetCurrentThread
GetDateFormatA
EnumSystemLocalesA
GetLogicalDriveStringsW
GetProcAddress
RemoveDirectoryW
GetCurrentProcess
UnlockFile
SystemTimeToFileTime
GetTickCount
QueryPerformanceCounter
LCMapStringA
CloseHandle
GetDiskFreeSpaceExW
OpenWaitableTimerW
ReadConsoleOutputA
GetStringTypeExA
OpenMutexA
SetFilePointer
VirtualQuery
GetCurrentThreadId
HeapCreate
LeaveCriticalSection
GetOEMCP
lstrlen
FindFirstFileExW
GetLocaleInfoA
IsValidLocale
GetModuleFileNameW
ExitThread
CompareFileTime
SetHandleCount
WriteConsoleOutputCharacterA
SetStdHandle
ReadConsoleOutputW
GetFullPathNameW
EnterCriticalSection
GetModuleHandleA
WritePrivateProfileStructW
GetEnvironmentStringsW
GetCalendarInfoW
IsValidCodePage
TerminateProcess
TlsAlloc
VirtualProtect
CompareStringW
GetStdHandle
WriteConsoleA
UnhandledExceptionFilter
LoadModule
TlsSetValue
GetFileType
GetDiskFreeSpaceW
FreeEnvironmentStringsA
WriteConsoleOutputW
RtlUnwind
HeapFree
IsDebuggerPresent
GetTimeZoneInformation
CreateMailslotA
HeapAlloc
ReadFile
GetStartupInfoA
OpenWaitableTimerA
CreateSemaphoreW
HeapLock
WideCharToMultiByte
InitializeCriticalSection
GetLastError
CompareStringA
SetConsoleOutputCP
GetCurrentProcessId
WriteFile
LocalCompact
LCMapStringW
CreateMutexA
SetConsoleTextAttribute
LoadLibraryA
FlushViewOfFile
shell32
SHGetFileInfo
DoEnvironmentSubstA
ShellHookProc
Sections
.text Size: 168KB - Virtual size: 164KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 260KB - Virtual size: 258KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 112KB - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 84KB - Virtual size: 83KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ