Static task
static1
Behavioral task
behavioral1
Sample
5f400fec848f17be545ea95a08bb9df9_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5f400fec848f17be545ea95a08bb9df9_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5f400fec848f17be545ea95a08bb9df9_JaffaCakes118
-
Size
160KB
-
MD5
5f400fec848f17be545ea95a08bb9df9
-
SHA1
5bcdc5feb5d2b1b995489ac15e6a93d5fad3d23e
-
SHA256
3eddf8cd82f7fc4ea125d7216565bee906da024754fd1930e2706b1da9390501
-
SHA512
7cc6b56bf03539009cd4b1ea00ca80bd2e7aa20f76c9f7664c8e7a999d81ff5a73cb5ad0fee9db60e18469ec2bc9b302b08e90c1caaf87a1855692ab497343c2
-
SSDEEP
3072:I+51N+adao3XRsMEZOD2HByVFPXNOfkQx/gFEj7ll9vLH8Tix6R2ZN0i9OxtHp:bjYa0oRsM8eXPsHRTcRobmH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5f400fec848f17be545ea95a08bb9df9_JaffaCakes118
Files
-
5f400fec848f17be545ea95a08bb9df9_JaffaCakes118.exe windows:5 windows x86 arch:x86
4cfd932c52672905615f617cfe6bc595
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msi
ord65
user32
GetWindowDC
GetDesktopWindow
AnyPopup
kernel32
GetCommandLineW
VirtualAlloc
GetPriorityClass
GetCurrentProcessId
GetEnvironmentStringsW
CreateEventA
CreateSemaphoreA
GetUserDefaultLCID
GetVersionExA
GetEnvironmentStrings
GetProcAddress
GetModuleHandleA
GetCommandLineA
CreateMutexA
GetTimeZoneInformation
GetLocaleInfoW
CompareStringA
CompareStringW
IsDebuggerPresent
TlsSetValue
GetStartupInfoA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
GetCurrentThreadId
SetEnvironmentVariableA
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
GetCurrentThread
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
WriteFile
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
FatalAppExitA
GetCPInfo
GetACP
GetOEMCP
HeapAlloc
HeapReAlloc
IsBadWritePtr
LoadLibraryA
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
InterlockedDecrement
InterlockedIncrement
Sleep
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
gdi32
GetTextColor
SetTextAlign
GetTextMetricsA
GetRasterizerCaps
AbortDoc
Sections
.text Size: 41KB - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 111KB - Virtual size: 198KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 608B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ