Static task
static1
Behavioral task
behavioral1
Sample
6853ea8c1542a6d31ede6f1f853c905c_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
6853ea8c1542a6d31ede6f1f853c905c_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
6853ea8c1542a6d31ede6f1f853c905c_JaffaCakes118
-
Size
252KB
-
MD5
6853ea8c1542a6d31ede6f1f853c905c
-
SHA1
fe895dd70ff1f8632acf3bb5b4d3a61d13af7bcd
-
SHA256
02d8546da4f0d029b8df34ad1b6c119a97dcec43d6dd8f7768e3cb4b74cbb0ae
-
SHA512
d50284c3c27d362f22d90875f736245e4dad52071de2caa844950e9c9a93c5962b4da7579061589349202fcdf20dfa97a5535dedcfa646275d0d0b7ab9e8a969
-
SSDEEP
6144:xId079u0236C/DkLqMAo74a3l/wOjjf0jF1zLYpH/XRe:uEALkuMAojYO30jFOpH/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6853ea8c1542a6d31ede6f1f853c905c_JaffaCakes118
Files
-
6853ea8c1542a6d31ede6f1f853c905c_JaffaCakes118.exe windows:4 windows x86 arch:x86
8e4ffada0d4bb5946be829009347cc79
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCurrentProcess
lstrcpynA
lstrlenA
GetLastError
GetFullPathNameA
GetFileAttributesA
lstrcpynW
lstrlenW
GetFileAttributesW
FreeLibrary
MultiByteToWideChar
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
Sleep
LocalFree
GetTickCount
GetModuleFileNameW
GetVersionExW
LocalAlloc
LoadLibraryW
GetLocalTime
GetProcAddress
LoadLibraryA
user32
EnableWindow
SetForegroundWindow
SendMessageW
GetMenuState
ShowCaret
CreateAcceleratorTableW
SetTimer
GetMenuItemID
GetMenuInfo
PostMessageW
GetCapture
CreateDesktopA
GetSubMenu
wsprintfA
CreateDialogIndirectParamW
LoadMenuW
AppendMenuA
CharPrevA
SetWindowTextW
SetDlgItemInt
TrackPopupMenuEx
GetForegroundWindow
GetSysColor
TrackPopupMenu
IsWindow
LoadIconA
wsprintfW
GetDlgItemTextA
GetMessageW
DialogBoxParamA
AdjustWindowRect
GetCursorPos
CopyIcon
MonitorFromPoint
CreateDialogParamA
GetKeyState
SetCursor
CharNextA
SetDlgItemTextW
GetDCEx
advapi32
RegCreateKeyExW
RegEnumKeyW
RegSetValueExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegDeleteKeyW
RegDeleteKeyA
shell32
SHGetDesktopFolder
security
SealMessage
CompleteAuthToken
gdi32
CreatePolygonRgn
CreateScalableFontResourceW
StretchDIBits
GetTextExtentPointA
SelectBrushLocal
CreateFontIndirectExA
AddFontResourceW
Sections
.text Size: 14KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xSHu Size: 2KB - Virtual size: 476KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.xCaD Size: 104KB - Virtual size: 172KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.G Size: 4KB - Virtual size: 125KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.oBZ Size: 5KB - Virtual size: 464KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 379KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Pi Size: 105KB - Virtual size: 166KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ