Static task
static1
Behavioral task
behavioral1
Sample
875b60a37eed2fa5670b1e292f00cb8b_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
875b60a37eed2fa5670b1e292f00cb8b_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
875b60a37eed2fa5670b1e292f00cb8b_JaffaCakes118
-
Size
3.8MB
-
MD5
875b60a37eed2fa5670b1e292f00cb8b
-
SHA1
c586d7ae290d57bf13df24fc6474c0259542769b
-
SHA256
0aa0b905a8dcc741ff64eb5510dcca3c64b40aaf0a3154848ea4c83b83f5fcfe
-
SHA512
0ef32cf32de0402af9fba20b59c92f70232576e9310ab8ff704ece133584beffbcd998d8bb0e7b0021a650ef70835d56f40d6d17ae4bb3b7c7bfb5ea43a52ce8
-
SSDEEP
98304:quG42RnADYYdbcloAqgUlVYGuoT9STED6I8sDxHYhv9TV:quLQADYw+ErfHuoTITEDZ5xHotV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 875b60a37eed2fa5670b1e292f00cb8b_JaffaCakes118
Files
-
875b60a37eed2fa5670b1e292f00cb8b_JaffaCakes118.exe windows:4 windows x86 arch:x86
78a5fe08b38b0189dbf83a02ac6fc991
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
TryEnterCriticalSection
GetCommModemStatus
SetProcessAffinityMask
GetOEMCP
GetFullPathNameA
ClearCommBreak
WritePrivateProfileStringA
CreateProcessA
SetSystemTime
SetErrorMode
GetPrivateProfileSectionW
ScrollConsoleScreenBufferA
FlushFileBuffers
ExitProcess
lstrcmpA
GenerateConsoleCtrlEvent
user32
GetMenuDefaultItem
IsCharUpperW
SendNotifyMessageW
MonitorFromWindow
ExcludeUpdateRgn
WaitForInputIdle
DefWindowProcA
SetActiveWindow
CharNextA
GetWindowRgn
EnumDisplaySettingsExW
ClientToScreen
CreateDialogIndirectParamA
VkKeyScanW
SendMessageA
SetWindowTextA
SetCursorPos
GetClipboardData
SetPropA
ScreenToClient
GetParent
EnableMenuItem
LoadStringA
DestroyCaret
DefDlgProcA
GetNextDlgGroupItem
MsgWaitForMultipleObjects
GetMonitorInfoW
LoadStringW
RegisterHotKey
CharPrevW
GetWindowTextLengthW
SendDlgItemMessageA
GetClassInfoExA
SetCursor
IsRectEmpty
CharUpperW
SetForegroundWindow
GetDlgItem
RegisterDeviceNotificationW
CopyRect
DefFrameProcA
SetCapture
ExitWindowsEx
SetWindowPos
TabbedTextOutA
GetUserObjectInformationA
ToAscii
CreateIconIndirect
SetUserObjectSecurity
TrackPopupMenuEx
ToUnicodeEx
ModifyMenuW
CreateIcon
EnumChildWindows
ChildWindowFromPointEx
HideCaret
GetMessagePos
GetWindowLongW
MenuItemFromPoint
MonitorFromPoint
SetParent
gdi32
Ellipse
CreateDIBSection
RectInRegion
ExtTextOutW
CreatePatternBrush
AddFontResourceA
GetCurrentObject
OffsetClipRgn
StartDocA
GetWindowOrgEx
EnumEnhMetaFile
CreateICW
GetLayout
GetTextExtentPoint32A
FillRgn
CreateICA
EndDoc
SetGraphicsMode
GetBitmapBits
GetSystemPaletteEntries
ExtFloodFill
advapi32
DuplicateToken
CryptGenRandom
CryptReleaseContext
PrivilegeCheck
RegQueryValueExA
IsValidAcl
GetPrivateObjectSecurity
GetSecurityDescriptorOwner
RegQueryValueA
CreateServiceA
GetCurrentHwProfileW
OpenEventLogW
AddAccessAllowedAce
RegSetValueA
RegCloseKey
StartServiceCtrlDispatcherW
GetSecurityDescriptorLength
ReadEventLogW
CryptVerifySignatureW
MakeSelfRelativeSD
RegSaveKeyA
CryptSetKeyParam
GetUserNameA
InitiateSystemShutdownA
StartServiceA
LookupPrivilegeValueW
ImpersonateNamedPipeClient
RegSetValueExA
OpenSCManagerW
shell32
DragAcceptFiles
DragFinish
SHGetSettings
FindExecutableW
oleaut32
VariantCopy
QueryPathOfRegTypeLi
shlwapi
wvnsprintfW
StrFormatByteSizeA
StrCpyNW
Sections
.text Size: 13KB - Virtual size: 232KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3.5MB - Virtual size: 3.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ