Static task
static1
Behavioral task
behavioral1
Sample
5db09a8e32164e4669f5eadc0cf50182_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
5db09a8e32164e4669f5eadc0cf50182_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5db09a8e32164e4669f5eadc0cf50182_JaffaCakes118
-
Size
52KB
-
MD5
5db09a8e32164e4669f5eadc0cf50182
-
SHA1
597d16a19baf7d15a045be41c907b956d1de706b
-
SHA256
de08e3d24dc3cafea087936be9b2016951b0b9f5c96399b74c0cc3b2e1c945b6
-
SHA512
4d9d85cd2f56eea0b19624158bd251ca42a7c87032775fe53505eefdaa6aa90d3eb9a413acce7dd83ead564344395511b0024f7f02dc4159ed02ee6f295a8685
-
SSDEEP
768:sEqAVbpPSt8JrNlYSwp2pHW7pCJ5aU7UdeJ1bdzRqED5pAD6BDrNg:zP1JpWpQ27pCmU7+eJpdFZl6gxg
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5db09a8e32164e4669f5eadc0cf50182_JaffaCakes118
Files
-
5db09a8e32164e4669f5eadc0cf50182_JaffaCakes118.exe windows:4 windows x86 arch:x86
8c622f6d71aa3d07bd30e01a36f2f7fa
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrcpyA
lstrcatA
AllocConsole
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetVersion
GetLastError
GetModuleFileNameA
GetStdHandle
WriteFile
GetModuleHandleA
LCMapStringW
MultiByteToWideChar
GetStringTypeA
LCMapStringA
VirtualFree
HeapCreate
SetFilePointer
GetFileType
SetHandleCount
HeapDestroy
GetACP
GetCPInfo
GetOEMCP
FreeEnvironmentStringsW
FlushFileBuffers
CloseHandle
SetStdHandle
LoadLibraryA
GetProcAddress
VirtualAlloc
GetStringTypeW
GetStartupInfoA
GetCommandLineA
HeapFree
GetEnvironmentStrings
GetEnvironmentStringsW
WideCharToMultiByte
HeapAlloc
ExitProcess
TerminateProcess
GetCurrentProcess
RtlUnwind
UnhandledExceptionFilter
FreeEnvironmentStringsA
user32
GetFocus
SendDlgItemMessageA
EnableWindow
GetDlgItem
MessageBoxA
SetDlgItemTextA
GetDlgItemTextA
AppendMenuA
DialogBoxParamA
EndDialog
LoadIconA
GetSystemMenu
SetClassLongA
advapi32
RegCloseKey
RegEnumKeyA
RegOpenKeyExA
RegQueryValueExA
RegDeleteValueA
RegSetValueExA
RegEnumKeyExA
RegEnumValueA
RegCreateKeyExA
wsock32
WSACleanup
WSAStartup
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Sections
.text Size: 30KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1024B - Virtual size: 951B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ