Static task
static1
Behavioral task
behavioral1
Sample
380c61f090ca68fb85ea807703a4299f_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
380c61f090ca68fb85ea807703a4299f_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
380c61f090ca68fb85ea807703a4299f_JaffaCakes118
-
Size
144KB
-
MD5
380c61f090ca68fb85ea807703a4299f
-
SHA1
ee01487bda1867259e8e8902bc508c6fb02f5c6a
-
SHA256
b719b677b02dfe1d4da6ec0a2eb71a39b2049f5f0f63dfd18123cf12bdf382eb
-
SHA512
cbd08b4d4024a8cde83c4de48e08177103c5e9a39f2a2fa09dec76f15d15c635955dc92611d6c0a6954049e00c1a933721af58547fab49ccbac8c253a2a38bde
-
SSDEEP
3072:dWpQp+7QEiV4jOgqVOG04eYzIUo+OaUm7KBg8p0:dWqp+hiVOOg07n0UokzLi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 380c61f090ca68fb85ea807703a4299f_JaffaCakes118
Files
-
380c61f090ca68fb85ea807703a4299f_JaffaCakes118.exe windows:4 windows x86 arch:x86
955baedc0763f5d17d37917018b1d2eb
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
AppendMenuW
GetFocus
GetCursorPos
GetWindowLongW
CallWindowProcW
GetClassInfoExW
GetWindowTextLengthW
GetKeyNameTextW
RegisterClassExW
SetFocus
FindWindowW
GetWindowTextW
EnumChildWindows
GetAsyncKeyState
GetDC
GetClassNameW
UpdateWindow
GetMessagePos
gdi32
AbortDoc
SetRectRgn
CombineRgn
EndDoc
GetTextMetricsW
SetAbortProc
winspool.drv
GetJobW
OpenPrinterW
DocumentPropertiesW
ClosePrinter
kernel32
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetModuleFileNameW
RtlUnwind
GetCommandLineW
GetCommandLineA
SetHandleCount
GetStdHandle
GetFileType
MultiByteToWideChar
GetStartupInfoA
IsBadWritePtr
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
GetModuleFileNameA
SetStdHandle
FlushFileBuffers
CreateFileA
LoadLibraryA
GetSystemDirectoryW
WriteConsoleW
GetProcAddress
LoadLibraryW
GetTickCount
Sleep
DeleteCriticalSection
CreateFileW
SetEndOfFile
GetFileSize
CreatePipe
CloseHandle
WaitForSingleObject
DeviceIoControl
GlobalUnlock
MulDiv
GlobalAlloc
GlobalFree
UnhandledExceptionFilter
HeapDestroy
SetFilePointer
WriteFile
GetLastError
GetVersion
GetStartupInfoW
GetModuleHandleA
HeapAlloc
HeapFree
GetCurrentProcess
TerminateProcess
ExitProcess
ReadFile
advapi32
InitializeSecurityDescriptor
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
AllocateAndInitializeSid
FreeSid
OpenProcessToken
StartServiceCtrlDispatcherW
RegEnumKeyW
RegSetValueExW
RegisterServiceCtrlHandlerW
SetEntriesInAclW
SetSecurityDescriptorDacl
SetServiceStatus
DeleteService
GetTokenInformation
LookupPrivilegeValueW
OpenSCManagerW
OpenServiceW
OpenThreadToken
QueryServiceStatus
RegCreateKeyExW
RegDeleteKeyW
RegOpenKeyW
ole32
CoInitialize
CoUninitialize
CoCreateInstance
CoTaskMemFree
CoTaskMemAlloc
ws2_32
WSACreateEvent
getsockname
htons
socket
shutdown
setsockopt
WSACloseEvent
WSAWaitForMultipleEvents
WSASocketW
WSAGetOverlappedResult
getpeername
WSAConnect
gethostbyname
sendto
Sections
.text Size: 36KB - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 64KB - Virtual size: 442KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ