Static task
static1
Behavioral task
behavioral1
Sample
34da9a6ab45f22b77569677e4fb967c9_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
34da9a6ab45f22b77569677e4fb967c9_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
34da9a6ab45f22b77569677e4fb967c9_JaffaCakes118
-
Size
236KB
-
MD5
34da9a6ab45f22b77569677e4fb967c9
-
SHA1
533d716ec9cd455159ddc12445d9f12f5873c395
-
SHA256
73b9697825081a425859a5681bfa648e82b18bcc56c39a1eddd77210d53e5ab3
-
SHA512
2a8cd4d61d01920f96e40a34fcd79b6e2551eff56fd2e6299e9ae7e541cac2cbbaeba4d97adef9a1fdbea224b5a1d59b6e0b9a3630f08b331fe7b7a2c674732e
-
SSDEEP
6144:abYozkuqPMelqxgrC2jDWpRsQkDmXEjTXa:aB1qPMelqOrC2jDERkqXya
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 34da9a6ab45f22b77569677e4fb967c9_JaffaCakes118
Files
-
34da9a6ab45f22b77569677e4fb967c9_JaffaCakes118.exe windows:4 windows x86 arch:x86
45f5536ca8fc0482f564ecf7b5a5a56a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersion
LoadLibraryA
FreeLibrary
GetPrivateProfileStringW
GetCurrentProcess
GetProcAddress
GlobalLock
FindResourceW
InterlockedDecrement
DeleteFileW
CreateProcessW
GetFileSize
InterlockedIncrement
ReadProcessMemory
SetEndOfFile
CreateThread
FindResourceExW
LockResource
GetUserDefaultLangID
FreeResource
WaitForSingleObject
lstrcpyW
LoadLibraryW
GetModuleFileNameW
GlobalDeleteAtom
FindClose
user32
SetCursor
UpdateWindow
LoadCursorW
CreatePopupMenu
DispatchMessageW
VkKeyScanW
SetWindowPos
IsWindow
PostQuitMessage
DestroyMenu
GetSystemMetrics
GetClassNameW
RegisterWindowMessageW
DestroyIcon
RegisterHotKey
IsDlgButtonChecked
SetCapture
LoadImageW
PostMessageW
SystemParametersInfoW
SendMessageW
EndDialog
gdi32
BitBlt
CreateRoundRectRgn
CreateDCW
SelectObject
CreateSolidBrush
GetClipBox
CreateICW
advapi32
RegNotifyChangeKeyValue
RegSetValueExW
GetUserNameW
SetSecurityDescriptorDacl
LookupPrivilegeValueW
StartServiceW
Sections
.kafz Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.dzksv Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.nglv Size: 212KB - Virtual size: 211KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE