Static task
static1
Behavioral task
behavioral1
Sample
427f8053f42732cf73af8492691ac3e8_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
427f8053f42732cf73af8492691ac3e8_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
427f8053f42732cf73af8492691ac3e8_JaffaCakes118
-
Size
165KB
-
MD5
427f8053f42732cf73af8492691ac3e8
-
SHA1
04c912f2ffe4d5c0b01792c5a61acc2f24e0b528
-
SHA256
5b2f907b8eda170a2e3c994de662bb7fc24176427972ae748ee9dba023c959ff
-
SHA512
e421c4503858b33ff30f3edd30341135bf520d14ae841a80878cf3a59358c30a66fdfa7064712558f0c23f8b3915ef8d1d95ca3be8d9fefe83ebe8b9626dff72
-
SSDEEP
3072:wjZvft5E+VdxXt+8bv6OCQ7bqI9ZfdrYFAb86CmdNOnrC5AJymVJyOzHphj/EVEZ:wFft5EMx9IO/+IjfdrmAb8R+mJymmqpx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 427f8053f42732cf73af8492691ac3e8_JaffaCakes118
Files
-
427f8053f42732cf73af8492691ac3e8_JaffaCakes118.exe windows:4 windows x86 arch:x86
1bb65a4148a1b271a0469a567f48cb06
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_DEBUG_STRIPPED
Imports
user32
RealGetWindowClassA
ReleaseCapture
ValidateRect
InvalidateRgn
UpdateWindow
IsWindowEnabled
ExcludeUpdateRgn
IsWindow
SetCapture
EnableWindow
FlashWindow
DestroyWindow
ValidateRgn
GetCapture
GetUpdateRgn
mprapi
MprConfigServerConnect
MprConfigServerDisconnect
MprConfigGetFriendlyName
kernel32
LoadResource
CompareStringA
ConvertFiberToThread
FindNextFileW
FreeLibrary
LocalFileTimeToFileTime
SetErrorMode
GetCurrentProcess
FindResourceW
SetThreadIdealProcessor
GetStringTypeW
LocalFree
FileTimeToSystemTime
SetCurrentDirectoryW
LCMapStringW
EnumResourceNamesW
FindClose
IsBadReadPtr
LocalAlloc
RegisterWaitForSingleObject
FindFirstFileW
FileTimeToLocalFileTime
GetShortPathNameW
GetSystemDirectoryW
SetEnvironmentVariableW
GetOEMCP
GetLocalTime
SystemTimeToFileTime
SearchPathW
Sections
.text Size: 98KB - Virtual size: 98KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 63KB - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imul Size: 1024B - Virtual size: 380KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ