Static task
static1
Behavioral task
behavioral1
Sample
59cd9323c394595a301ee2d870e381d0_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
59cd9323c394595a301ee2d870e381d0_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
59cd9323c394595a301ee2d870e381d0_JaffaCakes118
-
Size
114KB
-
MD5
59cd9323c394595a301ee2d870e381d0
-
SHA1
9cb7d94fa8c3daa3c213a36821212d1967908481
-
SHA256
c222381601ddc95cef62e7f370ccb6d53d38732c6c5748108c2348e2b4ef7fbf
-
SHA512
1804a95c0dc5245038d78f44ded761588d7e7f3597a9a85b42f1eeb0f84701cec8e3af90b22ec7e1732f40a0e250a9dae050a1f2d25674485d43b2021ccf39ef
-
SSDEEP
1536:P76urfYOR8G87xMwtM4Y/hpDmB5ESCAFS/5svJ7brD+826LSi6mOTF39SAhy6C3/:P76urfNGHiu5Vxy5KJ7bXatjwPMhi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 59cd9323c394595a301ee2d870e381d0_JaffaCakes118
Files
-
59cd9323c394595a301ee2d870e381d0_JaffaCakes118.exe windows:4 windows x86 arch:x86
f94f6571b8a725208ed950515195fe30
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
gdi32
SetStretchBltMode
GetTextMetricsA
CreateCompatibleDC
GetObjectA
CreateSolidBrush
SelectPalette
SetTextAlign
LineTo
SelectObject
SaveDC
GetDeviceCaps
DeleteDC
RectVisible
RestoreDC
GetClipBox
CreatePalette
DeleteObject
SetMapMode
GetPixel
GetStockObject
SetTextColor
user32
GetParent
GetDC
GetSystemMetrics
CharNextA
GetDesktopWindow
TranslateMessage
kernel32
lstrcmpiW
GetModuleHandleA
GetCommandLineA
GetSystemTime
CopyFileA
lstrlenA
DeleteFileA
GlobalFindAtomA
lstrcmpA
lstrlenW
RemoveDirectoryA
QueryPerformanceCounter
lstrcmpiA
RemoveDirectoryW
FindClose
GetWindowsDirectoryA
VirtualAlloc
VirtualFree
glu32
gluNurbsCallback
Sections
.text Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 53KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 30KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ