Static task
static1
Behavioral task
behavioral1
Sample
429dd1d9ef48af12ccb05e128dd2be01_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
429dd1d9ef48af12ccb05e128dd2be01_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
429dd1d9ef48af12ccb05e128dd2be01_JaffaCakes118
-
Size
131KB
-
MD5
429dd1d9ef48af12ccb05e128dd2be01
-
SHA1
db535533fe51dbf4386e2cfebff601f31131b108
-
SHA256
17ee07226d5aa63d1e18eb90843b80817858ac5330015dfca76fa2f54b291a99
-
SHA512
f8a48866372127a211e6d9be68f2332409ef26977b64bf0c0507b4b429e6cdcb4bff59ab30a244953e49ff6e4ca433175c24eb980d7998f4ff5ac82428c7cf06
-
SSDEEP
3072:rYi4LCRpQPjkVmRO5XlFTG/mSovCVJsFMHPVFP6mtW:kLLCsLONTG+S/VJrPV8mg
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 429dd1d9ef48af12ccb05e128dd2be01_JaffaCakes118
Files
-
429dd1d9ef48af12ccb05e128dd2be01_JaffaCakes118.exe windows:4 windows x86 arch:x86
3956303627afa356e864d0212a08a55c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
VirtualProtect
lstrcmpA
WaitForSingleObject
IsBadReadPtr
SetCurrentDirectoryA
GetModuleHandleA
GetVersionExA
OutputDebugStringA
GetSystemTime
OpenProcess
GetStartupInfoA
CopyFileA
VirtualFree
msvcrt
_controlfp
exit
_acmdln
signal
__p__commode
__setusermatherr
__p__fmode
free
__getmainargs
_setmode
_ultoa
strrchr
_amsg_exit
strncmp
_XcptFilter
_adjust_fdiv
_isatty
_wcsnicmp
strncat
_except_handler3
abort
__set_app_type
memchr
_initterm
log10
gdi32
GetTextExtentPoint32W
GetWindowOrgEx
GetDIBColorTable
StartDocA
SetWindowOrgEx
GetTextCharsetInfo
GetTextExtentPointW
CopyEnhMetaFileA
StartDocW
GetNearestPaletteIndex
version
VerInstallFileA
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoW
GetFileVersionInfoSizeA
ole32
CreateBindCtx
CoGetClassObject
RevokeDragDrop
CoRevokeClassObject
CreateItemMoniker
RegisterDragDrop
shell32
DragQueryFile
SHGetSpecialFolderPathW
SHGetFolderLocation
SHGetPathFromIDList
CommandLineToArgvW
ShellExecuteExW
ShellExecuteW
SHFileOperationW
SHBrowseForFolderW
DoEnvironmentSubstW
ExtractIconExA
DragQueryFileW
advapi32
RegOpenKeyW
IsValidSid
CopySid
InitializeAcl
RegEnumKeyExA
RegCreateKeyExW
RegQueryValueA
CheckTokenMembership
FreeSid
OpenServiceW
RevertToSelf
comctl32
ImageList_DragEnter
InitializeFlatSB
ImageList_EndDrag
ImageList_Create
ImageList_Destroy
CreatePropertySheetPageW
ImageList_SetIconSize
ImageList_Add
user32
CharNextA
GetMessagePos
WaitMessage
DeleteMenu
SetForegroundWindow
UpdateWindow
oleaut32
SafeArrayPtrOfIndex
SysAllocStringByteLen
SysReAllocStringLen
VariantClear
SafeArrayCreate
VariantCopyInd
SafeArrayGetElement
CreateErrorInfo
LoadTypeLib
SafeArrayUnaccessData
SafeArrayPutElement
Sections
.text Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 17KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 95KB - Virtual size: 168KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE