Static task
static1
Behavioral task
behavioral1
Sample
40a0db24337a58e5aa8f0c7b5d88f53f_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
40a0db24337a58e5aa8f0c7b5d88f53f_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
40a0db24337a58e5aa8f0c7b5d88f53f_JaffaCakes118
-
Size
104KB
-
MD5
40a0db24337a58e5aa8f0c7b5d88f53f
-
SHA1
19146e175f9f4932fbd4f49df7db6f092dc1d258
-
SHA256
d0512d5823da8f1cd809e3450086288ec24df7e30861b3637fa81bc9f7ced186
-
SHA512
1ce9fbdfce2c1aa7f7a28e54ec58e29eea62c583ee0b330d14267260034cbada73d545454f486340fa9ab153b71b10b3faec9357372d736cc12345e5adcd8469
-
SSDEEP
1536:zp4OxsCEi6QmZQmRFeYw/1yvh3JgFeRbvjHk7/J8NvH6Mj786WQY:zp41i941RsYHL3nEDJ85H2B
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 40a0db24337a58e5aa8f0c7b5d88f53f_JaffaCakes118
Files
-
40a0db24337a58e5aa8f0c7b5d88f53f_JaffaCakes118.exe windows:4 windows x86 arch:x86
9c5236d9b6cce96d022fd6b694590be9
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
user32
UpdateWindow
TranslateMessage
ShowWindow
SetUserObjectSecurity
SetSystemCursor
SetRect
RemoveMenu
RegisterShellHookWindow
RegisterClassA
PeekMessageA
OpenClipboard
MsgWaitForMultipleObjects
MessageBoxW
LoadIconA
GetTopWindow
GetKeyState
GetForegroundWindow
EnumPropsA
EmptyClipboard
DispatchMessageA
DialogBoxParamA
CharLowerW
CharToOemA
CreateWindowExA
DefWindowProcA
DestroyWindow
CharLowerBuffA
advapi32
GetOverlappedAccessResults
TraceEventInstance
SystemFunction008
SetUserFileEncryptionKey
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
LsaSetInformationTrustedDomain
LsaQueryTrustedDomainInfo
LsaClearAuditLog
IsValidSid
InitializeSecurityDescriptor
GetTrusteeNameW
GetSecurityDescriptorDacl
GetAce
CryptGetHashParam
ConvertAccessToSecurityDescriptorW
BuildExplicitAccessWithNameW
AddAccessDeniedAce
kernel32
GetTempPathW
GetSystemInfo
GetWindowsDirectoryA
GetModuleHandleA
GetLogicalDriveStringsW
GetFileAttributesExA
HeapAlloc
HeapCreate
HeapFree
GetTimeZoneInformation
LocalShrink
GetConsoleMode
MulDiv
OpenJobObjectW
ReadFile
RemoveDirectoryW
SetEnvironmentVariableA
WaitForMultipleObjectsEx
lstrcatA
IsProcessorFeaturePresent
GetVersionExA
GetCurrentProcessId
GetDriveTypeW
GetEnvironmentStringsA
GetProcessWorkingSetSize
BeginUpdateResourceA
ClearCommBreak
CloseHandle
CreateFileA
CreateRemoteThread
CreateSemaphoreA
DeleteCriticalSection
DuplicateHandle
EnumTimeFormatsA
EraseTape
ExitProcess
FormatMessageA
GetCommandLineA
GetConsoleOutputCP
GetExitCodeProcess
winmm
waveOutUnprepareHeader
waveOutRestart
timeKillEvent
auxOutMessage
joyGetPos
midiOutCacheDrumPatches
waveInReset
mmioInstallIOProcA
mixerGetLineInfoA
version
VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
ole32
PropVariantClear
IsEqualGUID
StgPropertyLengthAsVariant
dinput
DirectInputCreateW
ws2_32
listen
WSAStringToAddressA
WSAUnhookBlockingHook
closesocket
connect
gethostbyname
htons
WSAGetLastError
socket
shell32
SHGetSpecialFolderPathW
ShellExecuteA
SHFileOperationW
Sections
.text Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ