Static task
static1
Behavioral task
behavioral1
Sample
5c07492ae1c0d62dc193e9925ad7f3ad_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5c07492ae1c0d62dc193e9925ad7f3ad_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
5c07492ae1c0d62dc193e9925ad7f3ad_JaffaCakes118
-
Size
107KB
-
MD5
5c07492ae1c0d62dc193e9925ad7f3ad
-
SHA1
f6a9a27ccd5fa94c004474754f5ad73b87df5ff8
-
SHA256
0c173641f7eb464799da20536cc98806b291f93a09590ce972bb125ea4831e82
-
SHA512
f5d238956fff2eea09d56a0ab156b275fe8bb6964fd3b0f5513154b769e1711e407f22c9803af0f2239a41e63e5355c833182cd8ebac680c25bd76f143bf1c2b
-
SSDEEP
1536:iPPEyu6yr1OY+4RI2WGBoxj54UrMW1jFLuMSADz72mMyWsSsM:iPP7u7x5WqU+UgW/yuDvPxWs
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5c07492ae1c0d62dc193e9925ad7f3ad_JaffaCakes118
Files
-
5c07492ae1c0d62dc193e9925ad7f3ad_JaffaCakes118.exe windows:4 windows x86 arch:x86
ec56ff4a0ae274c36bc94f9bccf139b8
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
user32
PostQuitMessage
SetWindowPos
UnhookWindowsHookEx
SetWindowTextA
EnumWindows
FrameRect
EqualRect
GetMessageA
GetSysColorBrush
GetSubMenu
EnableMenuItem
GetScrollPos
GetSysColor
kernel32
ExitProcess
GetTickCount
GetThreadLocale
GetCurrentProcessId
InterlockedExchange
FileTimeToSystemTime
GetTimeZoneInformation
GetTempPathA
VirtualAllocEx
RtlUnwind
GetSystemTime
SetUnhandledExceptionFilter
GetStartupInfoA
GetFileAttributesA
GetOEMCP
gdi32
CopyEnhMetaFileA
FillRgn
GetMapMode
DPtoLP
SetViewportExtEx
ExcludeClipRect
SelectClipPath
CreateICW
CreateCompatibleBitmap
ole32
DoDragDrop
CoTaskMemRealloc
StgOpenStorage
CoRevokeClassObject
OleRun
StringFromGUID2
CoInitializeSecurity
CoInitialize
CoCreateInstance
advapi32
GetUserNameA
RegQueryValueExW
GetSecurityDescriptorDacl
RegCreateKeyA
CryptHashData
CheckTokenMembership
FreeSid
AdjustTokenPrivileges
QueryServiceStatus
RegCreateKeyExW
msvcrt
_mbscmp
strncpy
__setusermatherr
_fdopen
strlen
strcspn
raise
iswspace
_flsbuf
__initenv
__getmainargs
fflush
_CIpow
signal
puts
fprintf
_strdup
_lock
comctl32
ImageList_Write
ImageList_Destroy
CreatePropertySheetPageA
ImageList_LoadImageA
ImageList_DragEnter
ImageList_SetIconSize
ImageList_GetIcon
ImageList_GetBkColor
ImageList_DrawEx
ImageList_LoadImageW
InitCommonControls
ImageList_GetIconSize
ImageList_ReplaceIcon
shell32
ShellExecuteEx
CommandLineToArgvW
SHGetPathFromIDList
SHBrowseForFolderA
DragQueryFileA
ExtractIconExW
ExtractIconW
DragAcceptFiles
ShellExecuteW
DoEnvironmentSubstW
DragQueryFileW
oleaut32
VariantCopy
SafeArrayGetUBound
SysReAllocStringLen
SafeArrayPtrOfIndex
SafeArrayCreate
SafeArrayPutElement
SafeArrayRedim
SafeArrayUnaccessData
Sections
.text Size: 33KB - Virtual size: 33KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 33KB - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
kyvfgpb Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE