Static task
static1
Behavioral task
behavioral1
Sample
4b67b725a4505fd2f49aecbb66a1b063_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
4b67b725a4505fd2f49aecbb66a1b063_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
4b67b725a4505fd2f49aecbb66a1b063_JaffaCakes118
-
Size
97KB
-
MD5
4b67b725a4505fd2f49aecbb66a1b063
-
SHA1
c94df891b09d301d507c4f0b84a8364815f5f77c
-
SHA256
a87b1d2f10a3a469dcec75e500b8889bd018f138531d9dcdaa0970deaafa991a
-
SHA512
1d52f9575544db159a3ee8eb7567f6b38a0f5a479d4807dc77797cfc48909ee10f5d4e38ae74febbd05a49634943cde472aabdf7d1f854b6ce99a8d2c83a8cc7
-
SSDEEP
1536:mzZnEY1vWJ/JXMOh6Uf01yo8E3JTDKMGWGx75a0hUaaXv5loGw8Z+j+jRt5hzA:mWOvOqLXNDKdDmRaafYlUD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4b67b725a4505fd2f49aecbb66a1b063_JaffaCakes118
Files
-
4b67b725a4505fd2f49aecbb66a1b063_JaffaCakes118.exe windows:5 windows x86 arch:x86
b3bce2a8158cb6c87a17cc9819f165c0
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleA
lstrcmpA
lstrlenA
IsDebuggerPresent
GetTickCount
GetCurrentThread
GetThreadLocale
VirtualAlloc
GetACP
GetCurrentProcess
GetStartupInfoA
GetUserDefaultLangID
GetProcessHeap
CopyFileA
GetCurrentThreadId
QueryPerformanceCounter
DeleteFileA
GetDriveTypeA
GetOEMCP
GetModuleHandleW
GlobalFindAtomW
GlobalFindAtomA
lstrcmpiA
GetConsoleOutputCP
GetCommandLineA
GetWindowsDirectoryA
GetCommandLineW
RemoveDirectoryW
lstrcmpiW
RemoveDirectoryA
MulDiv
DeleteFileW
ExitProcess
lstrlenW
GetVersion
GetCurrentProcessId
gdi32
DeleteDC
SetTextColor
GetTextMetricsA
SetTextAlign
CreateFontIndirectA
CreateCompatibleDC
CreatePen
GetClipBox
GetPixel
GetStockObject
LineTo
PatBlt
RestoreDC
SelectPalette
RectVisible
DeleteObject
GetObjectA
SaveDC
SetStretchBltMode
CreatePalette
CreateSolidBrush
SelectObject
GetNearestPaletteIndex
SetMapMode
GetDeviceCaps
user32
GetDesktopWindow
CharNextA
GetSystemMetrics
GetDC
GetParent
TranslateMessage
glu32
gluQuadricCallback
Sections
.text Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 65KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ