Static task
static1
Behavioral task
behavioral1
Sample
38e8f771f261560529fb50a6913be2ea_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
38e8f771f261560529fb50a6913be2ea_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
38e8f771f261560529fb50a6913be2ea_JaffaCakes118
-
Size
208KB
-
MD5
38e8f771f261560529fb50a6913be2ea
-
SHA1
17da1d0cfd7374b5c149e5710b50e90e37b600d5
-
SHA256
392aac7fe5cc0eae32c5ebd6891aa93a85818346b2c09c266967c3e495c4c998
-
SHA512
c9f87ad7d4d0b6e2309b3efe0e20d1e4859c9cd9da7b9e1e79ee4ce2ee2af0ec441256c99ae1863ee6f9a1f4e135c845980d39d59bbd2f63ecda100da7be8509
-
SSDEEP
3072:hbrOv4sPI9fdU+yu1eSCyS1u/Pdrumtzjylas+5/DJRolBXB3Vi1TM2:lqv4skP1e00APdrylSmxI1TJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 38e8f771f261560529fb50a6913be2ea_JaffaCakes118
Files
-
38e8f771f261560529fb50a6913be2ea_JaffaCakes118.exe windows:4 windows x86 arch:x86
244cb3427296bec27b556202adec1910
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
maxdb
ThruGetPtr
DbScale
ThruCreate
DbCalcMinMax
DbClose
DbSave
ConnRepair
SymCreate
ThruGet
CompFind
CompDelete
MemAllocUnion
ObsCreate
DbDefault
ObsPut
MemFreeUnion
DbGet
ThruPut
CompCreate
SymGet
SymPut
ObsGet
CompGet
CompPut
ObsDelete
TextCreate
DbRepair
NameStr
DbLoadExtended
NameFind
DllInit
LangInit
SwFindFile
lstrCat
lstrCpy
OutMode
DebugEnabled
LogStr
TextGet
NameCreate
TextPut
LevFind
mfc42
ord5277
ord324
ord3597
ord1576
ord4465
ord3873
ord823
ord926
ord3098
ord355
ord2515
ord3092
ord3874
ord3499
ord858
ord5953
ord6334
ord4224
ord6199
ord470
ord755
ord2379
ord1146
ord2863
ord4160
ord2370
ord2301
ord540
ord4673
ord1168
ord5572
ord2915
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord2725
ord4079
ord4698
ord5307
ord5289
ord5714
ord2982
ord3147
ord3259
ord4425
ord3136
ord3262
ord2985
ord3081
ord2976
ord3830
ord3831
ord3825
ord3079
ord4080
ord4622
ord4424
ord3738
ord815
ord561
ord825
ord641
ord800
ord860
ord2621
ord5265
ord4376
ord4853
ord4998
ord4710
ord2514
ord6052
ord4078
ord1775
ord4407
ord5241
ord2385
ord5163
ord6374
ord4353
ord5280
ord3798
ord4837
ord4441
ord2648
ord2055
ord6376
ord3749
ord5065
ord1727
ord5261
ord2446
ord2124
ord4234
ord4627
msvcrt
_setmbcp
_stricmp
_unlink
longjmp
_strerror
getenv
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
_XcptFilter
_exit
_onexit
__dllonexit
free
tmpnam
_snprintf
_iob
strtol
strtod
fgets
_vsnprintf
strrchr
__CxxFrameHandler
_strnicmp
sprintf
fclose
fprintf
fputs
time
strchr
_ftol
_setjmp3
_hypot
realloc
atoi
strncpy
calloc
_access
exit
_fullpath
strcspn
strspn
strstr
fopen
kernel32
GetStartupInfoA
GetModuleHandleA
WinExec
OpenFile
GetModuleFileNameA
user32
LoadCursorA
SetCursor
GetFocus
GetSystemMetrics
GetClientRect
IsIconic
LoadIconA
GetSystemMenu
DrawIcon
SendMessageA
EnableWindow
AppendMenuA
MessageBoxA
Sections
.text Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
zgourdm Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 136KB - Virtual size: 136KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE