Static task
static1
Behavioral task
behavioral1
Sample
40b73751a538afe44ebce97c763278ee_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
40b73751a538afe44ebce97c763278ee_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
40b73751a538afe44ebce97c763278ee_JaffaCakes118
-
Size
379KB
-
MD5
40b73751a538afe44ebce97c763278ee
-
SHA1
d9e466fa740f492526c26b5601729ee84bceadab
-
SHA256
c37bbbadacf7d9995bfe594372f65119ba45a84be09430f3b648705e60353234
-
SHA512
ba71eb6f528c349fc1a482af134cf02014f5d4d9590530482c2b072f1dce90c52680962ffe8511fd652565be033f278675e4e00da6f39be2194b5c5b97c651d2
-
SSDEEP
6144:x13XDCiwQltoQzVhrXl437gUId27+4tVW8vUYMAVsLakFQbbdeBneWhpzMYl1ufo:/XDC84QzVFXl4cMG8vmUsBibQpzjhlAj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 40b73751a538afe44ebce97c763278ee_JaffaCakes118
Files
-
40b73751a538afe44ebce97c763278ee_JaffaCakes118.exe windows:5 windows x86 arch:x86
ed6a75f3e7ef2c95c224862831421f7b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetSystemTimeAsFileTime
GetCurrentProcessId
GetStartupInfoA
ExitProcess
GetTickCount
CreateEventW
QueryPerformanceCounter
GlobalMemoryStatus
GetDiskFreeSpaceExW
GetLongPathNameA
Process32First
Process32Next
OpenProcess
OpenThread
SuspendThread
ResumeThread
lstrcpyA
CreateToolhelp32Snapshot
Thread32First
Thread32Next
DeleteFileW
GetModuleFileNameW
CreateDirectoryW
SetFileAttributesW
CreateDirectoryA
SetFileAttributesA
OutputDebugStringW
OutputDebugStringA
GetModuleFileNameA
SetCurrentDirectoryA
GetCommandLineA
GetModuleHandleW
GetTempPathW
GetPriorityClass
ResetEvent
SetEvent
LeaveCriticalSection
EnterCriticalSection
WaitForSingleObject
RaiseException
TerminateThread
CloseHandle
CreateThread
SetThreadPriority
Sleep
GetCurrentProcess
SetPriorityClass
SetErrorMode
GetCurrentThreadId
lstrlenA
lstrcmpiA
DeleteCriticalSection
InitializeCriticalSection
GetLastError
WideCharToMultiByte
MultiByteToWideChar
GetVersionExA
user32
FindWindowW
SendMessageA
PostMessageA
EnableWindow
PeekMessageA
GetDesktopWindow
RegisterClassA
GetWindowTextA
GetWindowThreadProcessId
IsIconic
GetMessageA
EnumThreadWindows
wvsprintfW
DispatchMessageA
TranslateMessage
LoadIconA
LoadCursorA
RegisterClassExA
FindWindowA
CreateWindowExA
ShowWindow
UpdateWindow
BeginPaint
EndPaint
PostQuitMessage
DestroyWindow
DefWindowProcA
UnregisterClassA
IsWindowVisible
wininet
HttpSendRequestA
InternetOpenA
InternetOpenUrlA
InternetReadFile
InternetCloseHandle
HttpOpenRequestA
InternetConnectA
odbc32
SQLFreeConnect
shell32
SHGetSpecialFolderPathA
ShellExecuteExW
shlwapi
PathRemoveFileSpecW
PathAppendW
PathFileExistsW
PathFileExistsA
advapi32
RegDeleteValueA
RegOpenKeyExA
RegQueryInfoKeyW
RegEnumValueW
RegEnumValueA
RegQueryValueExW
RegSetValueExW
RegDeleteValueW
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegFlushKey
RegCloseKey
ole32
CoInitialize
CoUninitialize
CoCreateInstance
Sections
.text Size: 265KB - Virtual size: 265KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.init Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 103KB - Virtual size: 436KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ