Static task
static1
Behavioral task
behavioral1
Sample
441064a62c58b0fc5baa79ca4f9db4ae_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
441064a62c58b0fc5baa79ca4f9db4ae_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
441064a62c58b0fc5baa79ca4f9db4ae_JaffaCakes118
-
Size
99KB
-
MD5
441064a62c58b0fc5baa79ca4f9db4ae
-
SHA1
0e562cda2b2d02da366bc4bfde9c5286fb0bcd33
-
SHA256
445cb359d66765a5bb31d4e56aa5c4849ac8562c49595a597a64daf3373f750e
-
SHA512
4cd5c3ec25ea96d6afee02e95f79db2a3118ce20ce60d5a7d603a786d866cc1435c8780adb8c714f8d6e2c21ca7651e0920c6f75a9f4a8c627afa8ac6db0c7be
-
SSDEEP
1536:v4ZDf7skiOrc7m+VdlM9ZjnH7qlg33D4QvAFPePVykd:wxrUpVdO9Z7m233sVFSv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 441064a62c58b0fc5baa79ca4f9db4ae_JaffaCakes118
Files
-
441064a62c58b0fc5baa79ca4f9db4ae_JaffaCakes118.exe windows:4 windows x86 arch:x86
100ec052bd2cfff4e8967abf79c3f502
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
RemoveDirectoryA
GetUserDefaultLangID
GetWindowsDirectoryA
QueryPerformanceCounter
IsDebuggerPresent
GetOEMCP
MulDiv
GetModuleHandleA
lstrlenW
GetDriveTypeA
DeleteFileW
GetStartupInfoA
CopyFileA
GetCurrentThread
GetTickCount
GetCurrentProcessId
lstrlenA
GetProcessHeap
GetModuleHandleW
lstrcmpiA
GetConsoleOutputCP
GlobalFindAtomA
SetCurrentDirectoryA
GetThreadLocale
GetVersion
GlobalFindAtomW
RemoveDirectoryW
GetCurrentProcess
GetACP
GetCommandLineW
lstrcmpiW
GetCurrentThreadId
lstrcmpA
GetCommandLineA
ExitProcess
DeleteFileA
VirtualAlloc
gdi32
SetTextColor
GetStockObject
SetStretchBltMode
SetTextAlign
PatBlt
CreatePalette
DeleteObject
RectVisible
CreateSolidBrush
SaveDC
GetPixel
CreatePen
LineTo
GetClipBox
DeleteDC
CreateFontIndirectA
SetMapMode
GetObjectA
SelectPalette
CreateCompatibleDC
GetDeviceCaps
GetNearestPaletteIndex
SelectObject
GetTextMetricsA
RestoreDC
user32
GetDesktopWindow
TranslateMessage
GetSystemMetrics
CharNextA
GetDC
GetParent
glu32
gluQuadricCallback
Sections
.text Size: 21KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 66KB - Virtual size: 65KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ