Static task
static1
Behavioral task
behavioral1
Sample
779a6d07f70f78901e9918c5598bdca0_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
779a6d07f70f78901e9918c5598bdca0_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
779a6d07f70f78901e9918c5598bdca0_JaffaCakes118
-
Size
151KB
-
MD5
779a6d07f70f78901e9918c5598bdca0
-
SHA1
c257a03d11f2455dbcf38d93a091e579ff379f3d
-
SHA256
9e647323a538e13d0cdbc43d8983750cc1ea25ba453dc407809bb8fc03da1798
-
SHA512
9be7f8b81cebc30a925ec78e3bdeb6b0e6125c5f00bb1bdd06972a420ddc228aef78d1eb73dc17247639080c9c3af860621588e01853d97addb3d5da01ed9c9c
-
SSDEEP
3072:MU/07pV1P+aFVywa3lkzTx3amzmMR8OWW1tmHicS2bHdMwFeGzOXGP5IV+RyhyBE:MU/6+SVvxqBM9pt6icf9vy+ck
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 779a6d07f70f78901e9918c5598bdca0_JaffaCakes118
Files
-
779a6d07f70f78901e9918c5598bdca0_JaffaCakes118.exe windows:5 windows x86 arch:x86
5716eb8d47516648122a6ed0feecd3b1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
user32
PostMessageA
GetKeyboardLayout
DrawTextA
PostMessageW
CallWindowProcW
UpdateWindow
HideCaret
DestroyWindow
EnableWindow
SendNotifyMessageA
PostThreadMessageA
GetKeyNameTextW
MessageBoxA
GetMessageA
DestroyMenu
GetCursorPos
InvalidateRect
SetPropA
GetDoubleClickTime
ToAscii
CharLowerBuffA
GetWindowLongW
DefFrameProcA
EqualRect
UnhookWindowsHookEx
GetClientRect
MapWindowPoints
FillRect
AdjustWindowRectEx
GetDlgItem
InsertMenuItemA
SetMenuItemInfoA
RemovePropA
UnregisterClassW
GetWindow
ole32
OleGetClipboard
IsAccelerator
RevokeDragDrop
CoUninitialize
CoDisconnectObject
gdi32
PlayEnhMetaFile
EnumFontsA
SetBrushOrgEx
SetTextAlign
CloseEnhMetaFile
SetWinMetaFileBits
GetFontLanguageInfo
ExtTextOutW
DeleteDC
GetEnhMetaFilePaletteEntries
CreateBrushIndirect
GetObjectA
DeleteObject
GetDIBColorTable
ExtCreatePen
CombineRgn
oleaut32
GetActiveObject
SysFreeString
SafeArrayCreate
SafeArrayGetElement
VariantCopyInd
SysAllocStringLen
SysAllocStringByteLen
VariantInit
dplaipes
_FDnorm
_FSinh
_Stod
_Nan
_Strxfrm
_FEps
_Dnorm
_LInf
_Dscale
_Stold
_Eps
_Stof
_Denorm
kernel32
GetThreadPriority
WaitForMultipleObjects
FileTimeToSystemTime
VirtualAlloc
MapViewOfFileEx
GetCurrentProcessId
OpenProcess
GetModuleHandleA
LeaveCriticalSection
TerminateProcess
GetComputerNameExA
CloseHandle
CreateFileMappingA
VirtualQuery
DeleteFileA
SetThreadLocale
GetCPInfo
GetFullPathNameA
LoadLibraryExA
FileTimeToDosDateTime
VirtualQuery
GetDiskFreeSpaceA
GlobalAddAtomA
UnmapViewOfFile
SleepEx
TerminateThread
LocalAlloc
GetVolumeInformationA
ExitProcess
MulDiv
lstrlenW
GetVersion
GetFileAttributesA
RaiseException
TerminateProcess
comctl32
ImageList_EndDrag
ImageList_Read
ImageList_GetBkColor
ImageList_SetIconSize
ImageList_DragEnter
wininet
InternetErrorDlg
InternetGetLastResponseInfoA
FtpOpenFileA
InternetSetOptionA
comdlg32
ChooseFontA
shell32
SHGetDesktopFolder
SHGetSpecialFolderPathA
version
GetFileVersionInfoSizeA
winmm
timeEndPeriod
PlaySoundA
advapi32
RegCreateKeyExA
Sections
.text Size: 144KB - Virtual size: 144KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ