Static task
static1
Behavioral task
behavioral1
Sample
4d8bb3b534f472fb1b8b45602036496e_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
4d8bb3b534f472fb1b8b45602036496e_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
4d8bb3b534f472fb1b8b45602036496e_JaffaCakes118
-
Size
170KB
-
MD5
4d8bb3b534f472fb1b8b45602036496e
-
SHA1
eeb3d6f5e0560ac93bc7d1703648f237ed436b7e
-
SHA256
00b1ce952a17e947f6e100bb3637745d94a409a773b4683c78ba2fc3c1e911c8
-
SHA512
dc70bc90dec9e60e6374647a4d43a066c0cbc8d852ad723895862a279a34101d8559004c02619774cc1d80028c5ce6e73cf83f2226f515e8583e6f9f53e831d0
-
SSDEEP
3072:goMX9u9KpxirhdrdmSI82fKGw1j8cKXtI82d21w:gBEKLK7rESI86KnoXw21
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4d8bb3b534f472fb1b8b45602036496e_JaffaCakes118
Files
-
4d8bb3b534f472fb1b8b45602036496e_JaffaCakes118.exe windows:4 windows x86 arch:x86
fe6a2b426e4a3fc61357e96adf2ebb7c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
GetDlgItem
DestroyWindow
EnumChildWindows
SendMessageA
IsWindow
CreateWindowExW
GetWindowThreadProcessId
shell32
SHGetFolderPathW
kernel32
GetLocaleInfoA
SetEndOfFile
AddAtomA
GetVersionExA
HeapDestroy
FreeEnvironmentStringsA
TlsGetValue
FreeEnvironmentStringsW
GetCurrentProcess
UnhandledExceptionFilter
GetEnvironmentStrings
GetSystemTimeAsFileTime
TlsFree
SetHandleCount
GetCPInfo
InterlockedExchange
GetStartupInfoA
WriteFile
VirtualQuery
GetStdHandle
TerminateProcess
EnumResourceNamesA
GetSystemInfo
lstrcatA
TlsAlloc
SetLastError
GetACP
GetFileType
HeapCreate
IsBadWritePtr
GetCurrentProcessId
GetEnvironmentStringsW
HeapSize
VirtualAlloc
TlsSetValue
VirtualFree
QueryPerformanceCounter
GetModuleFileNameA
GetOEMCP
SetUnhandledExceptionFilter
newdev
UpdateDriverForPlugAndPlayDevicesW
setupapi
CM_Get_Global_State
CMP_WaitNoPendingInstallEvents
SetupDiGetDeviceRegistryPropertyW
CM_Get_DevNode_Status
mprapi
MprConfigServerConnect
MprConfigServerDisconnect
MprConfigGetFriendlyName
iphlpapi
GetIpAddrTable
Sections
.text Size: 88KB - Virtual size: 484KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 78KB - Virtual size: 77KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ