Static task
static1
Behavioral task
behavioral1
Sample
688e36b93e80e26cce08fa7c18074504_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
688e36b93e80e26cce08fa7c18074504_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
688e36b93e80e26cce08fa7c18074504_JaffaCakes118
-
Size
157KB
-
MD5
688e36b93e80e26cce08fa7c18074504
-
SHA1
5f7a3611e3c81effb420d2d7aaef16d9971d6229
-
SHA256
a401b56f16e409e04f6f8155b22552a9119c56d64e43fb6e1320315260b746ee
-
SHA512
d4796b5252b08859b55589c2c0847207c7a162f6cfa4ecfe521d038a66520bae231a050e404fe6bbfff7319e1188eb7016d546bd081a3d7e6f1db1b51ac38be8
-
SSDEEP
3072:n1RPSShoo3UDdM6GyNL0Iyqg/CVgO7XchAE//G9va8KrAr9i:n1VSSShS6GyTh7ip//GlHKrYs
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 688e36b93e80e26cce08fa7c18074504_JaffaCakes118
Files
-
688e36b93e80e26cce08fa7c18074504_JaffaCakes118.exe windows:4 windows x86 arch:x86
7f5a3e426e4ed85ee804dabb1619d2af
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetVersionExW
LocalFree
lstrcpynW
FormatMessageW
TlsGetValue
GlobalUnlock
GlobalLock
GlobalAlloc
lstrlenW
lstrcpyW
GlobalFree
SetLastError
WideCharToMultiByte
GetProcAddress
GetModuleHandleA
LocalAlloc
LeaveCriticalSection
GlobalReAlloc
GlobalHandle
EnterCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedDecrement
CloseHandle
GetVersion
lstrcmpW
ReadFile
WriteFile
SetFilePointer
FlushFileBuffers
GetCurrentProcess
ExitProcess
RtlUnwind
GetSystemTimeAsFileTime
GetCommandLineA
user32
wvsprintfA
PostThreadMessageA
RegisterWindowMessageA
GetQueueStatus
DispatchMessageA
GetDesktopWindow
MsgWaitForMultipleObjects
ReleaseDC
GetDC
wsprintfA
CreateDialogParamA
PeekMessageA
DestroyWindow
ShowWindow
advapi32
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
ws2_32
WSARecv
oleaut32
VariantClear
SafeArraySetRecordInfo
VarCyFromDec
SetErrorInfo
Sections
.text Size: 66KB - Virtual size: 118KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 85KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 270B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ