Static task
static1
Behavioral task
behavioral1
Sample
3f5d1480422d37f889f1a999d50be1f4_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3f5d1480422d37f889f1a999d50be1f4_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3f5d1480422d37f889f1a999d50be1f4_JaffaCakes118
-
Size
266KB
-
MD5
3f5d1480422d37f889f1a999d50be1f4
-
SHA1
ffab13d6634fee375ed3bc2052df706f6d67f0dd
-
SHA256
71f6d3c7505f4ddc5944be1b619e3b7ba4eca9b2eca08b72b3e7fd66e047ccc3
-
SHA512
b24fd066ab99428522575d3d50258b7eec690e2188fca585e6260cdc740204339e45a7a01125d8643f987fc007a2f20a383f6e8cbe3085ab89fdcea8bf76e630
-
SSDEEP
6144:6ovYrpd/eLrnVMr1RMACcwM1Je/11VcHjO7XuJknLGtXtEBUvHSc:6cYrDe/nw1Recr1e1cDOqOuEkS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3f5d1480422d37f889f1a999d50be1f4_JaffaCakes118
Files
-
3f5d1480422d37f889f1a999d50be1f4_JaffaCakes118.exe windows:4 windows x86 arch:x86
e6b4ea17257887557274220e107583fc
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
wininet
InternetSecurityProtocolToStringW
DeleteUrlCacheContainerA
InternetSetCookieW
UnlockUrlCacheEntryFileW
GopherGetAttributeW
InternetSetOptionExW
InternetGoOnlineA
InternetHangUp
FtpGetFileW
RegisterUrlCacheNotification
CreateUrlCacheGroup
InternetCreateUrlA
InternetCombineUrlW
GopherFindFirstFileW
IsUrlCacheEntryExpiredW
comdlg32
ReplaceTextW
PrintDlgA
FindTextW
ChooseFontA
PageSetupDlgA
GetOpenFileNameA
GetSaveFileNameA
PageSetupDlgW
GetSaveFileNameW
user32
EnumThreadWindows
GetAltTabInfo
SystemParametersInfoW
CreatePopupMenu
DestroyCursor
DdeConnectList
GetUserObjectInformationW
WINNLSGetEnableStatus
SetScrollInfo
DdeInitializeA
GetPropA
EndMenu
FlashWindow
SetPropW
WindowFromDC
LoadCursorA
CharLowerBuffA
InsertMenuItemA
SetWinEventHook
EditWndProc
LoadCursorW
shell32
SHQueryRecycleBinW
SheChangeDirExW
SHBrowseForFolderA
DragQueryFileAorW
SHFileOperationA
SHInvokePrinterCommandW
SHGetPathFromIDList
SHGetDiskFreeSpaceA
DragFinish
InternalExtractIconListW
SHGetDataFromIDListA
ShellExecuteA
SHFileOperationW
SHInvokePrinterCommandA
DragAcceptFiles
SHGetFileInfoW
RealShellExecuteExA
DoEnvironmentSubstA
CheckEscapesW
SHGetSettings
kernel32
GetModuleHandleA
SetLastError
GetCPInfo
LCMapStringA
TerminateProcess
MultiByteToWideChar
FreeEnvironmentStringsW
ExitProcess
GetPrivateProfileSectionW
InitializeCriticalSectionAndSpinCount
HeapSize
GetCurrentProcessId
VirtualFree
SetStdHandle
GetDateFormatA
TlsSetValue
GetTickCount
PulseEvent
GetACP
FreeLibrary
GetLastError
SetEnvironmentVariableA
GetProcAddress
GetTimeFormatA
CompareStringW
RtlUnwind
WriteFile
GetStartupInfoW
GetLocaleInfoA
GetStartupInfoA
InterlockedIncrement
CompareStringA
SetConsoleCtrlHandler
GetFileType
GetUserDefaultLCID
IsValidCodePage
Sleep
GetStringTypeW
WideCharToMultiByte
GetEnvironmentStringsW
InterlockedDecrement
SetHandleCount
GetModuleFileNameA
GetSystemTimeAsFileTime
GetLocaleInfoW
EnumSystemLocalesW
HeapDestroy
LeaveCriticalSection
SetUnhandledExceptionFilter
GetModuleFileNameW
GetCurrentThread
GetCurrentThreadId
GetCommandLineW
DeleteCriticalSection
GetStringTypeA
HeapAlloc
GetStdHandle
IsValidLocale
TlsFree
IsDebuggerPresent
GetOEMCP
LoadLibraryA
LCMapStringW
VirtualQuery
InterlockedExchange
QueryPerformanceCounter
GetCurrentProcess
HeapCreate
VirtualAlloc
GetTimeZoneInformation
TlsGetValue
GetModuleHandleW
TlsAlloc
EnterCriticalSection
UnhandledExceptionFilter
EnumSystemLocalesA
HeapFree
HeapReAlloc
advapi32
CryptSignHashW
CryptHashData
CryptExportKey
RegSetKeySecurity
CryptEnumProviderTypesW
CryptSignHashA
CryptAcquireContextW
CryptVerifySignatureA
LookupSecurityDescriptorPartsW
LookupPrivilegeNameW
AbortSystemShutdownW
LookupAccountNameW
RegEnumValueW
DuplicateToken
RegCreateKeyExW
LookupPrivilegeValueW
Sections
.text Size: 115KB - Virtual size: 115KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 140KB - Virtual size: 148KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ