Static task
static1
Behavioral task
behavioral1
Sample
30f35ee5c74c6bae7226573076695c43_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
30f35ee5c74c6bae7226573076695c43_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
30f35ee5c74c6bae7226573076695c43_JaffaCakes118
-
Size
257KB
-
MD5
30f35ee5c74c6bae7226573076695c43
-
SHA1
bab3cd3c7d7cc2fdd06d1e4848cdd9a2b6dcaa9b
-
SHA256
7ed4bd4284f944f3a8a6bba2bfb907979e49d5f1b84b92495b6578f9120af313
-
SHA512
5ff5f937e2a7ca87dca4af4f213c254fea144abb8e155b1997766c39e55a5093bc80dbda19e87f6eb7b5fbeabf8d13d2ebeb3360240fc34bd3b161ce40557ea7
-
SSDEEP
6144:Ffse3VxxFEvW29pWwrAQb9PIX2tJQmerLUfRj6cJ0:FUeTxFypWwUQZQ2DuCum0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 30f35ee5c74c6bae7226573076695c43_JaffaCakes118
Files
-
30f35ee5c74c6bae7226573076695c43_JaffaCakes118.exe windows:4 windows x86 arch:x86
c88566f185e45549a6ffbec4cc71cf01
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
user32
IsIconic
ShowWindow
EnumWindowStationsW
GetWindowRect
SetRect
SetForegroundWindow
GetLastActivePopup
GetClientRect
dciman32
DCIBeginAccess
kernel32
GetLastError
GetModuleHandleW
GlobalUnlock
GetProcessHeap
CloseHandle
SetFileAttributesW
GetStdHandle
GlobalAlloc
DeleteFileW
GetShortPathNameA
GetModuleFileNameA
lstrcpynA
GetModuleFileNameW
CopyFileA
RemoveDirectoryW
GetModuleFileNameW
ExitProcess
FormatMessageA
CopyFileW
ExitProcess
GetModuleHandleA
DeleteFileA
GlobalFree
FreeLibrary
CompareStringW
LocalFree
GetShortPathNameW
GlobalLock
RemoveDirectoryA
SetFileAttributesA
LoadLibraryA
Sections
.text Size: 182KB - Virtual size: 181KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bore Size: 5KB - Virtual size: 122KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ