Static task
static1
Behavioral task
behavioral1
Sample
43d64a1410b8170e255b3398efd05e61_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
43d64a1410b8170e255b3398efd05e61_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
43d64a1410b8170e255b3398efd05e61_JaffaCakes118
-
Size
429KB
-
MD5
43d64a1410b8170e255b3398efd05e61
-
SHA1
8a8a5d9588e1341c199b297d82929d5819d14f4c
-
SHA256
3773c26963b6cb136b61f3ca49ea3db627dfb2b366b65ec658e2be6601c3a7c5
-
SHA512
7abf3b0f9dea14f16a2dbd7031f4918bc8d858f2c9ef8e614609d85ed5de8aaa778271c3defd7e6e3a8e63da19d4b6557645b2c394dc71c560a0f611d9e943f7
-
SSDEEP
12288:bRpjzBWP3uJyKQKeeABE6QIQYNBJRvJMS:bHjkckeA7mYNBTJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 43d64a1410b8170e255b3398efd05e61_JaffaCakes118
Files
-
43d64a1410b8170e255b3398efd05e61_JaffaCakes118.exe windows:4 windows x86 arch:x86
24752c3878095ce34a9717454549a298
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
InsertMenuA
DrawTextW
IsIconic
LoadKeyboardLayoutW
IntersectRect
MessageBoxW
ToUnicode
DefFrameProcW
SetMessageExtraInfo
ShowScrollBar
GetScrollBarInfo
GetGUIThreadInfo
BroadcastSystemMessageA
EndPaint
MonitorFromRect
GetForegroundWindow
ScreenToClient
WinHelpW
MessageBoxIndirectA
wininet
FtpCommandW
InternetConfirmZoneCrossing
InternetSetCookieW
shell32
ShellExecuteEx
FreeIconList
SHFileOperationA
ExtractAssociatedIconExA
SHBrowseForFolder
ExtractAssociatedIconW
SHGetSpecialFolderPathW
SHGetPathFromIDListW
ShellExecuteExA
ShellExecuteExW
SHGetNewLinkInfo
ExtractIconExW
SHBrowseForFolderW
SHQueryRecycleBinA
DoEnvironmentSubstA
ShellExecuteW
DragQueryFileA
ExtractIconW
SHInvokePrinterCommandA
SheChangeDirA
SHFreeNameMappings
SHGetPathFromIDListA
advapi32
CryptSignHashA
CryptVerifySignatureW
LogonUserA
RegCreateKeyExW
StartServiceW
RevertToSelf
AbortSystemShutdownW
RegCreateKeyW
RegEnumValueA
CryptReleaseContext
CryptCreateHash
RegConnectRegistryA
RegQueryValueA
RegSetValueExW
CryptSetProvParam
CryptDestroyKey
RegLoadKeyA
RegCreateKeyA
GetUserNameW
kernel32
GetModuleHandleA
GetLocaleInfoA
GetDateFormatA
TlsAlloc
TlsFree
RtlUnwind
GetStringTypeA
FreeLibrary
LeaveCriticalSection
GetCurrentThreadId
GetProcAddress
GetVersionExA
DeleteCriticalSection
GetTimeZoneInformation
FindFirstFileW
GetProcessHeap
OpenProcess
GetEnvironmentStringsW
GetCurrentProcess
InterlockedExchange
GetStartupInfoW
HeapSize
FillConsoleOutputCharacterW
TlsSetValue
CreateSemaphoreW
IsValidCodePage
Sleep
CompareStringA
UnhandledExceptionFilter
SetLastError
EnumSystemLocalesA
ExitProcess
HeapAlloc
SetSystemTime
GetACP
HeapDestroy
GetCurrentProcessId
GetCurrentThread
CreateFileMappingA
QueryPerformanceCounter
SetEnvironmentVariableA
GetLocaleInfoW
IsValidLocale
GetCommandLineW
GetStdHandle
LCMapStringA
FreeEnvironmentStringsA
IsDebuggerPresent
TerminateProcess
HeapCreate
GetEnvironmentStrings
GetTimeFormatA
SetUnhandledExceptionFilter
WriteFile
GetStartupInfoA
VirtualQuery
VirtualFree
EnterCriticalSection
GetModuleFileNameW
GetOEMCP
InitializeCriticalSection
GetUserDefaultLCID
HeapReAlloc
FreeEnvironmentStringsW
GlobalSize
WriteConsoleInputW
TlsGetValue
SetThreadAffinityMask
WideCharToMultiByte
GetSystemTimeAsFileTime
HeapFree
SetConsoleCtrlHandler
GetPrivateProfileStringW
GetTickCount
GetModuleFileNameA
GetStringTypeW
InterlockedIncrement
MultiByteToWideChar
GetCommandLineA
SetHandleCount
MoveFileExW
InterlockedDecrement
CompareStringW
VirtualAlloc
GetCPInfo
GetFileType
LoadLibraryA
LCMapStringW
GetLastError
comdlg32
PrintDlgA
LoadAlterBitmap
FindTextW
FindTextA
GetFileTitleA
ChooseFontW
Sections
.text Size: 145KB - Virtual size: 145KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 275KB - Virtual size: 274KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ