Static task
static1
Behavioral task
behavioral1
Sample
46f60b786d9bb6a10a67853f7e200b92_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
46f60b786d9bb6a10a67853f7e200b92_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
46f60b786d9bb6a10a67853f7e200b92_JaffaCakes118
-
Size
146KB
-
MD5
46f60b786d9bb6a10a67853f7e200b92
-
SHA1
3edb9e8adb14d38784dcd8bb75eebc0b95872d32
-
SHA256
24f153ec90ec7d263cf71cb2be331f5a93eb0af8edfd1fe6e683850c8aedfaa3
-
SHA512
2b9c3b9cf21a952a6ddbcaa8bb78e6440fd77f3551c93a7782f1400b1a3a5890a501047ae8e29f4188e05d1ce1d7c7a9d34c0a6be5bbfb1c1724c5c5cc375f42
-
SSDEEP
3072:sU55c8tUsoIplCeUolzUCvjPtiU7tGYeW/QXKKluT8xkgy4P:sD7GyolzUitiatGuYL4Qxo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 46f60b786d9bb6a10a67853f7e200b92_JaffaCakes118
Files
-
46f60b786d9bb6a10a67853f7e200b92_JaffaCakes118.exe windows:4 windows x86 arch:x86
c07da1eb997a41a00cddd4f83f735494
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
dorta32
UninstallHook
InstallHook
gdi32
SelectObject
LineTo
GetObjectA
GetDIBits
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
MoveToEx
user32
TranslateMessage
SendMessageA
ReleaseDC
RegisterClassExA
PostQuitMessage
OpenClipboard
GetWindowTextA
GetSystemMetrics
GetMessageA
GetForegroundWindow
GetDC
GetCursorPos
GetClipboardData
GetClassNameA
FindWindowExA
FindWindowA
DispatchMessageA
DefWindowProcA
CreateWindowExA
CloseClipboard
wsprintfA
kernel32
lstrlenA
lstrcpynA
lstrcpyA
lstrcmpA
lstrcatA
WriteFile
WinExec
SystemTimeToFileTime
Sleep
ReadFile
LocalFree
LocalAlloc
GlobalFree
GlobalAlloc
CloseHandle
CompareStringA
CreateDirectoryExA
CreateFileA
CreateThread
DeleteFileA
ExitProcess
FindClose
FindFirstFileA
FindNextFileA
GetCommandLineA
GetFileSize
GetModuleHandleA
GetProcAddress
GetSystemDirectoryA
GetSystemTime
advapi32
GetUserNameA
RegSetValueExA
RegQueryValueExA
RegCloseKey
RegCreateKeyExA
RegOpenKeyA
wsock32
connect
gethostbyname
htons
inet_addr
closesocket
recv
send
socket
inet_ntoa
WSAStartup
wininet
InternetGetConnectedState
Sections
.text Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE