Static task
static1
Behavioral task
behavioral1
Sample
3be444024c8e6a31f3be665ad3920492_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3be444024c8e6a31f3be665ad3920492_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3be444024c8e6a31f3be665ad3920492_JaffaCakes118
-
Size
114KB
-
MD5
3be444024c8e6a31f3be665ad3920492
-
SHA1
b5e98cebe0508b890b7979cc3d4c258f266b2afd
-
SHA256
856cd55c5e4755d9da923de7ec671ae5ab615705f8edaf89db075d99edc44c97
-
SHA512
83e832553c5afcc8c98b4572dcfd526c277f0db1a52373b2074e175f78523aa6dc075b2ecc5d17e36875f51fb5d6677f049bea2bc06635cd6eef56f54c0e05a9
-
SSDEEP
1536:vfM6P+RcOwW5AEg8Gu5J1cQ2aYgoczkwufL3OIf3XmxSLCCB89qIyTfG3i6EuvaU:nMRbIBu5JbbvIwcbfGx+Z3Dn+Z+Wqza
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3be444024c8e6a31f3be665ad3920492_JaffaCakes118
Files
-
3be444024c8e6a31f3be665ad3920492_JaffaCakes118.exe windows:5 windows x86 arch:x86
e67c1191272eb1c92d43998a05c1e943
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
gdi32
RectVisible
CreateCompatibleDC
CreatePalette
SaveDC
SelectPalette
DeleteObject
SetTextAlign
GetObjectA
CreateFontIndirectA
CreateSolidBrush
GetStockObject
GetPixel
SetTextColor
SetStretchBltMode
RestoreDC
GetDeviceCaps
DeleteDC
GetTextMetricsA
SetMapMode
LineTo
kernel32
lstrcmpiA
GetSystemTime
CopyFileA
RemoveDirectoryA
lstrcmpiW
lstrcmpA
GetWindowsDirectoryA
lstrlenW
QueryPerformanceCounter
RemoveDirectoryW
FindClose
GetCommandLineA
lstrlenA
DeleteFileA
GlobalFindAtomA
VirtualAlloc
GetModuleHandleA
VirtualFree
user32
TranslateMessage
GetParent
GetSystemMetrics
GetDC
GetDesktopWindow
CharNextA
glu32
gluNurbsCallback
Sections
.text Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 53KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 30KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ