Static task
static1
Behavioral task
behavioral1
Sample
2bf63870a3eb3c803fa97b3ad2a9a7f2_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2bf63870a3eb3c803fa97b3ad2a9a7f2_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
2bf63870a3eb3c803fa97b3ad2a9a7f2_JaffaCakes118
-
Size
761KB
-
MD5
2bf63870a3eb3c803fa97b3ad2a9a7f2
-
SHA1
82f06fcbb5b2c6f12bef4c273dd22147c31ed30d
-
SHA256
e91d58e986030de56894565ce005da1d367f9f3b8e18852594f866165d2f978b
-
SHA512
d962831c286dfc9dc07f7341166c838de05db6f4041ac028296deab4db752c95efc312c391000724c337439a81859b5c027c3de27668bf23e93d66f04f07e99d
-
SSDEEP
6144:OSA2ksW4vbZHr9Ss58o7LCYcC4Qk7/uzXFv2roElz7MbehUaIzuaM3RpAPtbR:OhBuZHZSs5iYcCSONNaIADA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2bf63870a3eb3c803fa97b3ad2a9a7f2_JaffaCakes118
Files
-
2bf63870a3eb3c803fa97b3ad2a9a7f2_JaffaCakes118.exe windows:4 windows x86 arch:x86
515323ef85cafc9d11eb23efe2107564
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ole32
CoTaskMemAlloc
CoInitialize
CoUninitialize
shell32
SHGetFileInfoA
olepro32
OleTranslateColor
comctl32
ImageList_DrawEx
ImageList_DragMove
ImageList_GetIcon
ImageList_AddIcon
ImageList_DragLeave
ImageList_DragEnter
ImageList_BeginDrag
InitCommonControlsEx
ImageList_EndDrag
ImageList_GetIconSize
ImageList_GetImageCount
ImageList_Create
DllGetVersion
ImageList_DragShowNolock
ImageList_Draw
ImageList_AddMasked
InitCommonControls
ImageList_Destroy
gdi32
GetObjectA
SelectObject
GetDeviceCaps
CreateFontIndirectA
DeleteDC
CreateCompatibleDC
CreateDCA
CreateDIBSection
GetPixel
SetTextColor
CreateBrushIndirect
CreatePenIndirect
OffsetWindowOrgEx
TextOutA
StretchDIBits
DeleteObject
CreateCompatibleBitmap
GetTextExtentPoint32A
BitBlt
SetBkMode
SetBkColor
kernel32
GetProcAddress
VirtualProtect
RtlMoveMemory
HeapFree
GetModuleHandleA
GetProcessHeap
RtlZeroMemory
LoadLibraryA
lstrcmpA
FreeLibrary
lstrlenA
GetVersion
MulDiv
lstrlenW
lstrcmpiA
HeapAlloc
MultiByteToWideChar
user32
SetWindowPos
DestroyIcon
LoadImageA
RemovePropA
GetWindowRect
CreateWindowExA
ScreenToClient
SetWindowsHookExA
ReleaseCapture
FillRect
InvalidateRect
DrawStateA
GetKeyState
UnhookWindowsHookEx
IsRectEmpty
UnionRect
VkKeyScanA
FindWindowExA
MoveWindow
EnableWindow
OffsetRect
SetActiveWindow
GetSysColor
DestroyWindow
DrawTextA
RedrawWindow
SetFocus
GetScrollInfo
SetWindowLongA
SystemParametersInfoA
SendMessageA
ReleaseDC
VkKeyScanW
WindowFromPoint
DestroyAcceleratorTable
PostMessageA
CreateAcceleratorTableA
InflateRect
GetFocus
GetDC
CallNextHookEx
GetSystemMetrics
GetAsyncKeyState
SetPropA
SetTimer
DrawEdge
DestroyCursor
GetActiveWindow
KillTimer
GetClientRect
GetCursorPos
GetPropA
UpdateWindow
IntersectRect
msvbvm60
EVENT_SINK_GetIDsOfNames
MethCallEngine
EVENT_SINK_Invoke
ord516
ord517
ord626
ord519
ord553
ord556
Zombie_GetTypeInfo
EVENT_SINK2_Release
ord592
ord593
ord594
ord595
ord598
ord520
ord709
VarPtr
ord631
ord525
ord526
EVENT_SINK_AddRef
ord527
ord560
PutMem1
ord562
PutMem2
DllFunctionCall
ord563
PutMem4
Zombie_GetTypeInfoCount
EVENT_SINK_Release
ord601
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord710
ord711
ord712
ord606
ord714
ord607
GetMem1
ord608
GetMem2
ord715
ord609
GetMem4
ord717
ord319
ProcCallEngine
ord537
ord644
ord538
ord539
ord572
ord573
EVENT_SINK2_AddRef
ord681
ord685
ord100
ord611
ord320
ord321
ord614
ord616
ord617
ord618
ord619
ord542
ord543
ord650
ord544
ord545
ord547
ord581
Sections
.text Size: 692KB - Virtual size: 690KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ