Static task
static1
Behavioral task
behavioral1
Sample
435ecdc53d7ff89adeea63d073193ce2_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
435ecdc53d7ff89adeea63d073193ce2_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
435ecdc53d7ff89adeea63d073193ce2_JaffaCakes118
-
Size
5.7MB
-
MD5
435ecdc53d7ff89adeea63d073193ce2
-
SHA1
c9ee260585d7da4c5e645953b8bed409b8d1326f
-
SHA256
00c03f4d8eabd60de51c686e32a951a2e12243b5f7282aed49dc8e7327a155f4
-
SHA512
d53ed0720f905195ae92f126b5bc3f2713edb144695cc606e3ecb22cd5fba45d650611fdae2a6c6e542c179016583727fd9dffc7e239b9040a7141ca7903b9bf
-
SSDEEP
98304:OxSL04Ivz/pCCnic2xafHixGnkUEXS48Zsq0FWNGpeawehf8EvEN0JPryaq:a804IvzYCicCafHLkUs8QFW8peWJrlq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 435ecdc53d7ff89adeea63d073193ce2_JaffaCakes118
Files
-
435ecdc53d7ff89adeea63d073193ce2_JaffaCakes118.exe windows:4 windows x86 arch:x86
601a28569525fc48c7f1e23e313a3297
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
gdi32
CopyEnhMetaFileA
GetClipBox
GetLayout
Pie
CreateBrushIndirect
Rectangle
comdlg32
FindTextW
PageSetupDlgW
oleaut32
SysFreeString
LoadTypeLi
SysStringLen
VariantCopy
SafeArrayCreate
SetErrorInfo
ws2_32
WSAUnhookBlockingHook
getprotobyname
shutdown
WSASendDisconnect
WSASocketW
user32
EnumChildWindows
CheckRadioButton
PostThreadMessageA
EndMenu
GetMenuState
GetScrollBarInfo
WaitMessage
LockWindowUpdate
GetCursorPos
GetMonitorInfoW
GetWindowRgn
CascadeWindows
GetSysColor
CreateDesktopW
LoadCursorW
TranslateMessage
GetClipCursor
kernel32
QueryDosDeviceW
GetModuleHandleA
GlobalReAlloc
LoadLibraryExW
OutputDebugStringW
GetAtomNameA
GetSystemInfo
GetCurrentProcessId
GetDriveTypeW
LeaveCriticalSection
GetCompressedFileSizeW
MoveFileExA
AreFileApisANSI
lstrcpynA
EraseTape
UnhandledExceptionFilter
SetEnvironmentVariableW
VirtualFree
WriteProcessMemory
FormatMessageW
VirtualQueryEx
GetBinaryTypeA
ExitProcess
Sections
.text Size: 12KB - Virtual size: 233KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5.5MB - Virtual size: 5.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ