Static task
static1
Behavioral task
behavioral1
Sample
3a9ea92d3076292d9db5ccf0a62a189c_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3a9ea92d3076292d9db5ccf0a62a189c_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3a9ea92d3076292d9db5ccf0a62a189c_JaffaCakes118
-
Size
636KB
-
MD5
3a9ea92d3076292d9db5ccf0a62a189c
-
SHA1
8ecf87a5b7bec0b108751ee6b620588a3948795e
-
SHA256
6e85404659057cff6b5d7566d3c796f138e99655a6edc68da16be4960b43f325
-
SHA512
25c27164f9d50d95c7be0b2d3c9d95663ffb6e62264553d44c063b72dc28bda9c0c0cd0ead9cab63c9bb082b4b2e1edcfec65edcc14740c797bd0b139260a2e8
-
SSDEEP
12288:f5qKJTNbGd/XvrvBxZIZuJbr9CUcb8ZnyALtqV67pTFD1lmphaHSb:7BS/XvrnZCsQZb89p86z106HSb
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3a9ea92d3076292d9db5ccf0a62a189c_JaffaCakes118
Files
-
3a9ea92d3076292d9db5ccf0a62a189c_JaffaCakes118.exe windows:4 windows x86 arch:x86
4c1a388c84c377d796e9250617a091b2
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
VirtualProtect
GetCurrentProcessId
GetTimeFormatA
FormatMessageA
DeleteAtom
GetModuleHandleA
HeapCreate
InterlockedExchange
GetCurrentThread
HeapDestroy
WriteConsoleA
LoadLibraryA
GetThreadPriority
FlushFileBuffers
GetEnvironmentStringsA
GetExpandedNameA
GetACP
GetStdHandle
IsDebuggerPresent
OpenSemaphoreA
GetCurrentProcess
user32
GetWindowTextLengthA
SetActiveWindow
FrameRect
GetDlgItem
BeginPaint
GetCursorPos
DragDetect
DrawTextA
GetFocus
GetWindow
GetClassNameA
FillRect
GetParent
EndPaint
ShowWindow
wsprintfA
ReleaseDC
GetTitleBarInfo
SetForegroundWindow
advapi32
RegCloseKey
RegCreateKeyA
RegFlushKey
RegQueryInfoKeyA
RegEnumKeyA
clbcatq
CoRegCleanup
Sections
.text Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1024B - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ