Static task
static1
Behavioral task
behavioral1
Sample
2e86a16cdf30d7273e6281b5c0dbb4f9_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2e86a16cdf30d7273e6281b5c0dbb4f9_JaffaCakes118.exe
Resource
win10v2004-20240708-en
General
-
Target
2e86a16cdf30d7273e6281b5c0dbb4f9_JaffaCakes118
-
Size
474KB
-
MD5
2e86a16cdf30d7273e6281b5c0dbb4f9
-
SHA1
3574f03c1bae31fe7050d999686813050f9851b4
-
SHA256
3a50956354824677b4f577645f5a9ab41b3eb831d34682b0355cfcb4d7b9046c
-
SHA512
b54cb979aa14db7416ec3cce1f70867e1a63e945bfba7eee56de6d559d7e125cd9d69b59ec67527a7f2ab8c87920f7bbd1a3ee816ba15aa7e2990aed2b3f67e5
-
SSDEEP
12288:mAQdjAHNPyk2JbV9XjONcWus6mkevCr1XUgP:Aq4PrzOuvsPapXUgP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2e86a16cdf30d7273e6281b5c0dbb4f9_JaffaCakes118
Files
-
2e86a16cdf30d7273e6281b5c0dbb4f9_JaffaCakes118.exe windows:4 windows x86 arch:x86
9ae309bd776458d59db5621652f76fbe
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
comdlg32
PrintDlgA
PageSetupDlgA
GetFileTitleW
ChooseFontA
GetFileTitleA
FindTextW
PageSetupDlgW
PrintDlgW
ReplaceTextW
ChooseFontW
LoadAlterBitmap
GetSaveFileNameW
user32
GetMenuCheckMarkDimensions
GetWindowTextW
GetClassNameA
DefMDIChildProcW
DeleteMenu
ToAscii
GetWindowModuleFileNameA
RegisterClassExW
ShowCursor
LockWindowUpdate
ReuseDDElParam
MessageBeep
CreateDialogParamA
CharNextA
UnregisterHotKey
SetPropA
CharToOemW
IsDialogMessageA
IsWindowUnicode
advapi32
CryptAcquireContextW
DuplicateTokenEx
LogonUserA
CryptGetProvParam
RegCreateKeyA
RegSetKeySecurity
CryptContextAddRef
CryptCreateHash
CryptVerifySignatureA
LookupAccountNameA
RegDeleteKeyW
RegEnumKeyA
RegSaveKeyA
CryptSetKeyParam
LookupAccountSidW
RegEnumKeyW
RegSetValueExW
CryptEnumProviderTypesW
CryptExportKey
RegQueryValueW
CryptDestroyHash
wininet
ShowSecurityInfo
InternetCanonicalizeUrlA
RetrieveUrlCacheEntryStreamW
GopherCreateLocatorW
FtpCreateDirectoryA
kernel32
GetACP
GetStringTypeA
MapViewOfFile
GetSystemTimeAsFileTime
GetModuleFileNameA
TlsAlloc
FreeEnvironmentStringsA
IsValidCodePage
ExitProcess
Sleep
GetCurrentThread
LCMapStringW
EnterCriticalSection
TlsGetValue
lstrcmpA
WideCharToMultiByte
LoadLibraryA
VirtualQuery
GetLocaleInfoA
GetTimeFormatA
RtlUnwind
GetStdHandle
HeapReAlloc
VirtualAlloc
ReadConsoleInputA
HeapDestroy
GetCPInfo
GetLocaleInfoW
GetCurrentThreadId
WriteFile
GetLogicalDriveStringsA
FreeLibrary
GetEnvironmentStringsW
SetConsoleCtrlHandler
GetFileType
FindFirstFileExA
GetModuleHandleW
ReleaseMutex
GetStringTypeW
FreeEnvironmentStringsW
MultiByteToWideChar
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
GetDateFormatA
GetCurrentProcessId
InterlockedExchange
GetTickCount
EnumSystemLocalesA
FlushViewOfFile
GetLastError
GetStartupInfoW
GetDriveTypeW
GetOEMCP
VirtualFree
InitializeCriticalSection
GetTimeZoneInformation
GetStartupInfoA
SetEnvironmentVariableA
SetUnhandledExceptionFilter
GetUserDefaultLCID
HeapCreate
GetProcessAffinityMask
HeapFree
GetEnvironmentStrings
GetCurrentProcess
SetFileAttributesA
QueryPerformanceCounter
HeapSize
TlsFree
GetNamedPipeInfo
DeleteCriticalSection
TlsSetValue
TerminateProcess
IsValidLocale
GetDriveTypeA
CompareStringW
CreatePipe
InterlockedDecrement
CompareStringA
LCMapStringA
GetModuleHandleA
SetHandleCount
SetLastError
LocalFree
GetProcAddress
IsDebuggerPresent
HeapAlloc
UnhandledExceptionFilter
InterlockedIncrement
GetCommandLineA
Sections
.text Size: 185KB - Virtual size: 184KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 277KB - Virtual size: 276KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ