Static task
static1
Behavioral task
behavioral1
Sample
055d2372a4fa3016360212f585570e19_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
055d2372a4fa3016360212f585570e19_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
055d2372a4fa3016360212f585570e19_JaffaCakes118
-
Size
677KB
-
MD5
055d2372a4fa3016360212f585570e19
-
SHA1
0193fe6e7e09bd409b202c023aa0592a4b591eac
-
SHA256
3dffa113b5477810501d564fd674f29422a12c013b77cf969434118194b42476
-
SHA512
6391ab02bfb626c0d92c066ebd21c29d4b5803c9674ddfe99728d8c01cfc05cfd8b2a3cf43e27e74984632e1a78b7e644f4eff1e172ce15c72f6e23de62082ce
-
SSDEEP
12288:sTBwM0x9x0edaS7bBF604oxY1VdMzeFupB+CnZPFMcOf+kD:sTpKfPkAbBFjAIeFenwb+U
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 055d2372a4fa3016360212f585570e19_JaffaCakes118
Files
-
055d2372a4fa3016360212f585570e19_JaffaCakes118.exe windows:4 windows x86 arch:x86
fb3b262d732dc5377285d5c2af414bf5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
DuplicateTokenEx
RegQueryValueExA
kernel32
InitializeCriticalSection
shlwapi
PathCombineW
PathRemoveFileSpecW
SHDeleteKeyA
StrCmpNIA
StrStrW
wnsprintfA
wnsprintfW
user32
ExitWindowsEx
FindWindowExA
GetCursorPos
GetWindowLongA
GetWindowTextA
LoadCursorA
SendMessageA
SetProcessWindowStation
SetThreadDesktop
Sections
.bqdef Size: 43KB - Virtual size: 60KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sbun Size: 1024B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.mngloh Size: 5KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ