Static task
static1
Behavioral task
behavioral1
Sample
4c0ac2e4e8af9839ca6bf8cbf08ff7f3_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
4c0ac2e4e8af9839ca6bf8cbf08ff7f3_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
4c0ac2e4e8af9839ca6bf8cbf08ff7f3_JaffaCakes118
-
Size
260KB
-
MD5
4c0ac2e4e8af9839ca6bf8cbf08ff7f3
-
SHA1
6eeaaa8c02898bd6ec325fa4449108a9895b8273
-
SHA256
66e0b9be67ac8ecea069e16dc2d4976ac4b04260ddd04aad1c3c5c5b2df36f25
-
SHA512
7503a7b7f37738bff449ffd4e17b2cc753c0612d7c82d4f6bd7c51d88178964f09f881aae5f7d3c855ac5a1e79f9642a0ca438ceed9498b7561a8cb459460986
-
SSDEEP
6144:9FAqgNMrMNnHGUS0mATGBqxwO54kBzPpSC5T0i8S:jUNKMQUzSwh5bBzseT0m
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4c0ac2e4e8af9839ca6bf8cbf08ff7f3_JaffaCakes118
Files
-
4c0ac2e4e8af9839ca6bf8cbf08ff7f3_JaffaCakes118.exe windows:4 windows x86 arch:x86
b445b15e50823e4ff2dc442d1004381b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleW
MulDiv
CreateEventW
SetErrorMode
ExpandEnvironmentStringsA
GetCurrentThreadId
IsDebuggerPresent
SetUnhandledExceptionFilter
MoveFileW
WaitForSingleObject
GetTimeFormatW
CreateMutexW
FileTimeToSystemTime
CompareFileTime
GetLocalTime
GetVolumeInformationW
LocalAlloc
LocalFree
GetDateFormatW
OpenEventW
GetTempPathW
CreateDirectoryW
RemoveDirectoryW
FreeLibrary
GetWindowsDirectoryW
GetSystemDirectoryW
GetProcAddress
user32
GetForegroundWindow
GetActiveWindow
SetCapture
SetWindowLongW
GetIconInfo
LoadCursorW
SetCursor
GetFocus
CopyRect
GetSystemMetrics
DestroyIcon
IsWindow
InvalidateRect
SendMessageW
GetSysColor
LoadIconW
LoadImageW
MessageBoxW
EnableWindow
gdi32
CreatePalette
CreateCompatibleDC
CreatePen
GetStockObject
CreateFontIndirectW
CreateSolidBrush
DeleteObject
CreatePatternBrush
advapi32
RevertToSelf
RegOpenKeyExA
RegQueryValueExA
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
RegSetValueExW
RegCloseKey
ImpersonateSelf
OpenThreadToken
OpenProcessToken
AllocateAndInitializeSid
InitializeSecurityDescriptor
GetLengthSid
InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
IsValidSecurityDescriptor
AccessCheck
FreeSid
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
shell32
ShellExecuteW
usp10
UspFreeMem
ScriptXtoCP
ScriptString_pcOutChars
ScriptShape
iprtrmgr
MapInterfaceToAdapter
Sections
.text Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.c Size: 2KB - Virtual size: 542KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.CxMAKg Size: 3KB - Virtual size: 660KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.yOruq Size: 1KB - Virtual size: 153KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.zgefqi Size: 78KB - Virtual size: 133KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.H Size: 3KB - Virtual size: 321KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 7KB - Virtual size: 270KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.hwA Size: 134KB - Virtual size: 164KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bfm Size: 2KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ