Static task
static1
Behavioral task
behavioral1
Sample
83195ea1318cb46ac00015228888237d_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
83195ea1318cb46ac00015228888237d_JaffaCakes118.exe
Resource
win10v2004-20240730-en
General
-
Target
83195ea1318cb46ac00015228888237d_JaffaCakes118
-
Size
59KB
-
MD5
83195ea1318cb46ac00015228888237d
-
SHA1
bab712a8d5506314c28fbf7d1ac18bc8c2b6da80
-
SHA256
5cc2d063ad7697a14faacf4f87ecc0a8a2cb8f51316d78fb8e6189dee6ed9c98
-
SHA512
61a37a5c4e0a625331560c7da22e402e35da5f5a6b548a20d5379bef04adfcd2a6e09cdd772e5b8102cd6c063aa198c5ec5265ea05daa04f6587cb24c60179c6
-
SSDEEP
1536:BBLGRUbcHCE79thA++wNCfyxRLDM8+wXLGYMDJ/:rLGqIHCatXF8LBCGYMDR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 83195ea1318cb46ac00015228888237d_JaffaCakes118
Files
-
83195ea1318cb46ac00015228888237d_JaffaCakes118.exe windows:4 windows x86 arch:x86
6a4e7605f4c5f741fbd4c23c4b3dd5d9
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
SHAutoComplete
SHIsLowMemoryMachine
StrRChrIA
StrChrIA
StrToIntExA
SHRegWriteUSValueA
PathRemoveBlanksA
UrlIsOpaqueA
HashData
PathFileExistsA
AssocQueryStringA
SHDeleteValueA
SHCreateStreamWrapper
PathFindOnPathA
StrIsIntlEqualA
StrFormatByteSize64A
SHRegEnumUSKeyA
PathCommonPrefixA
UrlCombineA
PathIsUNCA
StrCSpnA
PathQuoteSpacesA
PathGetDriveNumberA
PathStripToRootA
PathIsRelativeA
SHRegOpenUSKeyA
PathAppendA
ColorHLSToRGB
kernel32
_lread
InterlockedCompareExchange
SwitchToFiber
lstrlen
GlobalReAlloc
SetConsoleOutputCP
FlushConsoleInputBuffer
TlsFree
SetConsoleCursorPosition
DisconnectNamedPipe
ReadConsoleOutputA
GetTickCount
FindFirstFileA
GetLongPathNameA
GetProcessAffinityMask
lstrcpyn
GetTapeParameters
Heap32ListNext
LocalFree
GetConsoleOutputCP
HeapUnlock
WriteProcessMemory
CreateFileMappingA
IsBadWritePtr
MapViewOfFile
GetProcessHeaps
OpenSemaphoreA
GetCurrentThreadId
FreeLibrary
GetTempPathA
PrepareTape
CompareStringA
GetStringTypeExA
GetComputerNameA
DuplicateHandle
HeapCompact
GetOverlappedResult
SetCommTimeouts
SetTimeZoneInformation
FillConsoleOutputAttribute
BuildCommDCBA
Beep
GetProfileIntA
SetConsoleTextAttribute
FatalExit
InterlockedExchange
IsBadReadPtr
CloseHandle
InitializeCriticalSection
GetTimeZoneInformation
SizeofResource
VirtualFree
GetPrivateProfileIntA
ClearCommBreak
GetNamedPipeHandleStateA
SetupComm
SetCommBreak
GlobalFlags
SetProcessAffinityMask
UpdateResourceA
GetStdHandle
OpenProcess
advapi32
RevertToSelf
Sections
.diza Size: 22KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.oner Size: 5KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.mda Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xmbm Size: 27KB - Virtual size: 132KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ