Static task
static1
Behavioral task
behavioral1
Sample
71d1551c61e5da4b74d14bb3e418f328_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
71d1551c61e5da4b74d14bb3e418f328_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
71d1551c61e5da4b74d14bb3e418f328_JaffaCakes118
-
Size
170KB
-
MD5
71d1551c61e5da4b74d14bb3e418f328
-
SHA1
7ef4db062ea8772783e15b747f6ecea474bacc2d
-
SHA256
9167b8069e88f90a0435eaf59047e7c2160781a19633da0c1be6f9075111b159
-
SHA512
81ab17de34dffb017a85f390dbd71164649df964bfcf109b11f49100007b91631ab8c976d411fc0deaac6dee9f10943c0f892c92ce892283a007f938c612c810
-
SSDEEP
3072:QAxSgu/D4HwqCgIYf/ywCvXBfxrU2M8W2ElT3OpfqbKWD:QsJGclKdxrU2MLcWD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 71d1551c61e5da4b74d14bb3e418f328_JaffaCakes118
Files
-
71d1551c61e5da4b74d14bb3e418f328_JaffaCakes118.exe windows:5 windows x86 arch:x86
1acb423e15e2ac55fa1b9e16df87e552
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
IsDebuggerPresent
GetUserDefaultLangID
GetVersion
GetACP
GetThreadLocale
GetWindowsDirectoryA
GetTickCount
lstrcmpA
GetModuleHandleW
GlobalFindAtomW
lstrlenW
RemoveDirectoryA
DeleteFileW
GetCommandLineA
QueryPerformanceCounter
GetOEMCP
lstrcmpiA
GetDriveTypeA
GetCurrentThread
GetCommandLineW
GetCurrentThreadId
lstrcmpiW
GlobalFindAtomA
GetConsoleOutputCP
CopyFileA
GetStartupInfoA
SetCurrentDirectoryA
GetProcessHeap
GetCurrentProcess
MulDiv
GetCurrentProcessId
DeleteFileA
lstrlenA
VirtualAlloc
VirtualFree
gdi32
CreatePen
GetDeviceCaps
DeleteObject
GetObjectA
SelectObject
GetClipBox
SaveDC
RestoreDC
SetTextColor
GetPixel
LineTo
SelectPalette
SetTextAlign
SetMapMode
GetStockObject
CreateSolidBrush
PatBlt
GetTextMetricsA
SetStretchBltMode
CreateCompatibleDC
CreatePalette
RectVisible
DeleteDC
CreateFontIndirectA
user32
GetSystemMetrics
GetParent
CharNextA
TranslateMessage
GetDesktopWindow
GetDC
glu32
gluNurbsCallback
Sections
.text Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Gossuoqa Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 25KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Qhxntn F Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 101KB - Virtual size: 101KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 30KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ