Static task
static1
Behavioral task
behavioral1
Sample
6183daaf3a24ff57c66d35fcf3a218e7_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
6183daaf3a24ff57c66d35fcf3a218e7_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
6183daaf3a24ff57c66d35fcf3a218e7_JaffaCakes118
-
Size
1.6MB
-
MD5
6183daaf3a24ff57c66d35fcf3a218e7
-
SHA1
485c50603a62a4c38142fce1af7d2d70429ebc59
-
SHA256
055d18df0dd7a788a866d8252161780e5315c4bd4a70064eb2b6b3fae5e6f018
-
SHA512
2f301c8a41ee46a645fb2a7c6fc9fcca5f2101fc50a90882c93b77676970d885ec4bce2201f70fad9587bbd3b4e1e72c101319e99c65bc63b2a4315219b7e64f
-
SSDEEP
49152:EQscgH29U7/bc7QeWRV/dmae+9uPZX/+Aepo:DDez2Imae+cPZp
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6183daaf3a24ff57c66d35fcf3a218e7_JaffaCakes118
Files
-
6183daaf3a24ff57c66d35fcf3a218e7_JaffaCakes118.exe windows:4 windows x86 arch:x86
c32ef2e8f2aa1a9c9aed9840c243d862
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
CreateWindowExA
IsWindowEnabled
EnableWindow
MapWindowPoints
SetWindowTextA
GetWindowTextA
GetWindowTextLengthA
IsWindow
UpdateWindow
ShowWindow
IsWindowVisible
DispatchMessageA
TranslateMessage
GetMessageA
CharUpperA
GetDesktopWindow
CharLowerA
SetWindowLongA
GetWindowLongA
PostQuitMessage
MessageBoxA
GetWindowRect
CallWindowProcA
ReleaseDC
FillRect
GetSysColor
GetDC
DefWindowProcA
TrackMouseEvent
SendMessageA
GetParent
InvalidateRect
EndPaint
BeginPaint
MoveWindow
LoadCursorA
LoadIconA
SetWindowPos
wsprintfA
GetClassInfoExA
SetFocus
RegisterClassExA
kernel32
IsBadReadPtr
HeapReAlloc
ExitProcess
LocalFree
LocalAlloc
SetThreadContext
GetThreadContext
OpenThread
ResumeThread
SuspendThread
WriteFile
CreateFileA
VirtualFreeEx
WriteProcessMemory
VirtualAllocEx
OpenProcess
CreateRemoteThread
WideCharToMultiByte
GetSystemInfo
GetVersionExA
Sleep
WritePrivateProfileStringA
GetSystemDirectoryA
GlobalFree
GlobalAlloc
GetTickCount
DeleteFileA
GetPrivateProfileStringA
RtlFillMemory
GetModuleHandleA
LocalSize
lstrcpyn
RtlMoveMemory
OpenEventA
CloseHandle
CreateEventA
GetCurrentProcess
ReadProcessMemory
lstrlenA
WaitForSingleObject
GetProcessHeap
HeapAlloc
HeapFree
CreateThread
LoadLibraryA
GetProcAddress
FreeLibrary
GetModuleFileNameA
gdi32
DeleteObject
CreateFontA
SetTextColor
SetBkColor
CreateSolidBrush
DeleteDC
BitBlt
SelectObject
CreateCompatibleDC
GetObjectA
shell32
ShellExecuteA
wsock32
ioctlsocket
htons
connect
closesocket
recv
send
WSAStartup
ws2_32
WSAEventSelect
WSACreateEvent
WSACloseEvent
WSAEnumNetworkEvents
WSASocketA
comctl32
ord17
shlwapi
StrDupA
ntdll
NtQuerySystemInformation
Sections
Size: 508KB - Virtual size: 508KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ