Static task
static1
Behavioral task
behavioral1
Sample
368e2a0c8c0f7c43f92dd2ff6a7ddf60_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
368e2a0c8c0f7c43f92dd2ff6a7ddf60_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
368e2a0c8c0f7c43f92dd2ff6a7ddf60_JaffaCakes118
-
Size
115KB
-
MD5
368e2a0c8c0f7c43f92dd2ff6a7ddf60
-
SHA1
d1cb3dc7635bbd142abf1580c64d4c80ac9781aa
-
SHA256
7e3ecad7c81c3bdf246a61f6dc80fbda9c51d678f1bdd3234a27f11a160ebb2c
-
SHA512
a64c1e7ad8294496ade660f6605dfcbf1a724c9ef4cc6646f6cf6cd31b39b90e7c7bcd8ce33ecd669e9c32bca4d524ac3caac138404e37257bbf26fd609ad914
-
SSDEEP
1536:1N+JhQ5Man0omcVhIy4dsb+nX+6qjpWc+nmliQTU1faoM4op17hYJWyny7:iJhQBKBZpXdqFWdnOiDe4UFYJn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 368e2a0c8c0f7c43f92dd2ff6a7ddf60_JaffaCakes118
Files
-
368e2a0c8c0f7c43f92dd2ff6a7ddf60_JaffaCakes118.exe windows:4 windows x86 arch:x86
28cf8e55608a7689922040c478ac77b8
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
gdi32
DeleteObject
CreateCompatibleDC
GetDeviceCaps
CreatePalette
PatBlt
GetObjectA
SaveDC
RestoreDC
LineTo
CreateFontIndirectA
SelectObject
SetPixel
SetStretchBltMode
GetStockObject
SetMapMode
GetPixel
GetClipBox
SetTextAlign
CreateSolidBrush
SetTextColor
RectVisible
GetTextMetricsA
DeleteDC
CreatePen
SelectPalette
user32
GetSystemMetrics
CharNextA
GetDesktopWindow
TranslateMessage
GetParent
kernel32
GetConsoleOutputCP
GetACP
GetCurrentProcess
GlobalFindAtomW
lstrlenA
GetTickCount
GetThreadLocale
DeleteFileA
RemoveDirectoryA
lstrlenW
GetProcessHeap
GetCommandLineA
GetCurrentThreadId
GetDriveTypeA
RemoveDirectoryW
GetVersion
GetOEMCP
GetCommandLineW
GetStartupInfoA
lstrcmpiA
CopyFileA
GetCurrentThread
QueryPerformanceCounter
lstrcmpA
GetModuleHandleW
DeleteFileW
GetModuleHandleA
VirtualAlloc
IsDebuggerPresent
VirtualFree
GlobalFindAtomA
lstrcmpiW
GetUserDefaultLangID
SetCurrentDirectoryA
GetCurrentProcessId
GetWindowsDirectoryA
MulDiv
glu32
gluQuadricCallback
Sections
.text Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 78KB - Virtual size: 78KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ