Static task
static1
Behavioral task
behavioral1
Sample
4d1a7cab6b3e81577868f772405b1bda_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
4d1a7cab6b3e81577868f772405b1bda_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
4d1a7cab6b3e81577868f772405b1bda_JaffaCakes118
-
Size
2.0MB
-
MD5
4d1a7cab6b3e81577868f772405b1bda
-
SHA1
1d0258f25c56ec94b5081992759a9ea96688ae8e
-
SHA256
92e9e63fdd1bdc4472bc9169ee3bc12cee95541e14ddd60d0ea51a1ab8cae109
-
SHA512
43806d5849f0dc5c99898b4ad0c5a8d8f28c2acb0d1f1fda2de1ad85fe506bb96055ad26b5f13688f8f455fa4a8361a7b283cc45e50eecc899c95c43dc4c3453
-
SSDEEP
49152:xyryD3fRY0IcA2NkWMn7bU6UFS+B1zn1nz3:M2Y0IvWc7bqf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4d1a7cab6b3e81577868f772405b1bda_JaffaCakes118
Files
-
4d1a7cab6b3e81577868f772405b1bda_JaffaCakes118.exe windows:4 windows x86 arch:x86
e4d516250203896c3b8189a27a42a8ab
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
CryptHashSessionKey
InitiateSystemShutdownA
kernel32
GetCurrentProcessId
HeapDestroy
SetLastError
TlsAlloc
InterlockedIncrement
DeleteCriticalSection
WriteFile
GetStdHandle
HeapCreate
CreateWaitableTimerW
LCMapStringA
HeapAlloc
MultiByteToWideChar
HeapFree
CloseHandle
VirtualFree
GetLocalTime
GetSystemTimeAsFileTime
GetLastError
GetCurrentThread
EnterCriticalSection
SetHandleCount
TlsFree
TlsGetValue
RtlUnwind
FreeEnvironmentStringsA
GetTickCount
CreateMutexA
GetVersion
GetStringTypeA
GetCurrentThreadId
WideCharToMultiByte
UnhandledExceptionFilter
OpenMutexA
TlsSetValue
CompareStringW
GetStartupInfoA
GetModuleFileNameA
SetEnvironmentVariableA
GetCurrentProcess
FlushFileBuffers
VirtualQuery
GetStringTypeW
EnumCalendarInfoExA
GetFileType
SetFilePointer
GetCommandLineA
GetEnvironmentStrings
InterlockedExchange
LCMapStringW
CreateNamedPipeW
LeaveCriticalSection
GetTimeZoneInformation
GetSystemTime
SetStdHandle
HeapReAlloc
QueryPerformanceCounter
VirtualAlloc
InitializeCriticalSection
GetStartupInfoW
ExitProcess
GetCPInfo
GetModuleFileNameW
ReadFile
GetPrivateProfileStringA
GetEnvironmentStringsW
GetProcAddress
FreeEnvironmentStringsW
IsBadWritePtr
GetCommandLineW
GetModuleHandleA
ResumeThread
LoadLibraryA
TerminateProcess
InterlockedDecrement
CompareStringA
comctl32
ImageList_GetIcon
ImageList_Add
ImageList_Draw
InitCommonControlsEx
CreateStatusWindowA
ImageList_SetFlags
ImageList_LoadImage
CreatePropertySheetPageA
ImageList_GetImageCount
ImageList_LoadImageA
ImageList_Duplicate
ImageList_GetImageRect
ImageList_DrawEx
ImageList_Write
MakeDragList
ImageList_GetDragImage
ImageList_AddIcon
user32
ClipCursor
DefWindowProcW
DefFrameProcW
EditWndProc
SystemParametersInfoA
RegisterClassExA
ShowWindow
RegisterClassA
GetScrollRange
LoadKeyboardLayoutW
IsCharUpperA
TabbedTextOutA
GetMenuStringA
MessageBoxExA
DestroyWindow
SetProcessWindowStation
UnpackDDElParam
CreateWindowExA
SendIMEMessageExA
AnimateWindow
GetKeyboardLayout
MessageBoxA
RegisterClipboardFormatW
ChangeDisplaySettingsA
CallMsgFilter
wvsprintfW
SetMenuDefaultItem
WindowFromDC
InflateRect
LoadAcceleratorsA
wininet
FtpGetFileSize
InternetConfirmZoneCrossingA
FindFirstUrlCacheEntryExW
InternetTimeToSystemTime
GopherOpenFileA
GopherCreateLocatorW
InternetSecurityProtocolToStringW
comdlg32
ChooseColorW
ReplaceTextA
shell32
SHGetFileInfoA
Sections
.text Size: 130KB - Virtual size: 129KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 252KB - Virtual size: 264KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 56KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ