Static task
static1
Behavioral task
behavioral1
Sample
8a0cdaa477cb1b4ab65398e60b1f7006_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
8a0cdaa477cb1b4ab65398e60b1f7006_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
8a0cdaa477cb1b4ab65398e60b1f7006_JaffaCakes118
-
Size
343KB
-
MD5
8a0cdaa477cb1b4ab65398e60b1f7006
-
SHA1
788aac817483839a8181c479d6841ce9c2d6872c
-
SHA256
180495942f756c32f10ff3cab188092b9c1e5ce26d7dcc5974c557b5e87f2de9
-
SHA512
e3a762c8ce73e2c110ceac9a342637f9a73c779cbb43f28e58236a8b3ffb371368880deaa96e44532f05c01de554c2e6fdc5f4413130836c0c89bc130aafdaa5
-
SSDEEP
6144:iZo6VIafKPDTzzGH1I+7QNjO2ZImgR4qyetUDHaPuxVCGEZM2:6o6pKmHKtNyoImguMtGHaZ5ZM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8a0cdaa477cb1b4ab65398e60b1f7006_JaffaCakes118
Files
-
8a0cdaa477cb1b4ab65398e60b1f7006_JaffaCakes118.exe windows:4 windows x86 arch:x86
22a66f0a394843ae2f4b27fa52b7a31b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
shell32
ExtractIconExW
RealShellExecuteExA
RealShellExecuteW
ExtractIconExA
SHGetDiskFreeSpaceA
RealShellExecuteExW
ExtractIconEx
SHGetFileInfoA
CommandLineToArgvW
SHFileOperationA
DuplicateIcon
CheckEscapesW
ShellExecuteA
SHGetSpecialFolderPathW
user32
CreateCaret
UnpackDDElParam
DefDlgProcW
ModifyMenuA
GetUserObjectInformationA
SetWindowTextW
GetScrollPos
CreateWindowExA
DdeKeepStringHandle
CreateIconFromResource
LoadCursorA
InSendMessageEx
MapVirtualKeyExA
GetWindowWord
LoadCursorFromFileA
DispatchMessageA
MonitorFromPoint
BeginDeferWindowPos
RedrawWindow
SetCaretBlinkTime
GetSystemMetrics
GetMessagePos
GetScrollRange
LoadMenuIndirectW
advapi32
AbortSystemShutdownA
InitializeSecurityDescriptor
StartServiceA
CryptGetDefaultProviderW
RegConnectRegistryA
GetUserNameW
wininet
FtpDeleteFileW
ShowClientAuthCerts
DeleteUrlCacheContainerA
InternetInitializeAutoProxyDll
FindFirstUrlCacheContainerW
InternetShowSecurityInfoByURL
HttpSendRequestA
InternetQueryFortezzaStatus
RetrieveUrlCacheEntryFileW
InternetOpenW
InternetGoOnlineA
InternetLockRequestFile
InternetGetConnectedState
GopherFindFirstFileA
SetUrlCacheEntryGroupA
GetUrlCacheEntryInfoExA
IsHostInProxyBypassList
CreateUrlCacheGroup
InternetDialA
kernel32
FreeEnvironmentStringsA
SetUnhandledExceptionFilter
GetTickCount
SetEvent
HeapAlloc
WideCharToMultiByte
GetStartupInfoA
GetCPInfo
GetDateFormatA
HeapSize
GetCurrentThread
TlsFree
GetOEMCP
GetLongPathNameW
HeapFree
GetThreadContext
DeleteCriticalSection
VirtualQuery
FreeLibrary
LeaveCriticalSection
EnumResourceTypesW
HeapReAlloc
GetModuleHandleA
GetStringTypeW
InterlockedIncrement
LCMapStringW
GlobalAlloc
GetLocaleInfoW
GetEnvironmentStrings
VirtualFree
GetEnvironmentStringsW
Sleep
GetLastError
SetEnvironmentVariableA
GetProcessHeap
LCMapStringA
GetStringTypeA
GetCurrentProcessId
TlsGetValue
SetLastError
GetVersionExA
HeapCreate
GetCurrentThreadId
IsValidCodePage
RtlUnwind
MultiByteToWideChar
GetCommandLineA
HeapDestroy
GetCurrentProcess
GetSystemTimeAsFileTime
GetTimeZoneInformation
EnterCriticalSection
IsDebuggerPresent
WriteFile
CompareStringA
VirtualAlloc
TlsSetValue
SetHandleCount
GlobalFlags
InterlockedExchange
GetUserDefaultLCID
EnumSystemLocalesA
GetACP
LockFile
FreeEnvironmentStringsW
LoadLibraryA
SetConsoleCtrlHandler
ExitProcess
GetNumberFormatW
GetStdHandle
CompareStringW
UnhandledExceptionFilter
QueryPerformanceCounter
GetTimeFormatA
InterlockedDecrement
InitializeCriticalSection
IsValidLocale
GetModuleFileNameA
GetLocaleInfoA
TlsAlloc
GetFileType
TerminateProcess
GetProcAddress
Sections
.text Size: 164KB - Virtual size: 164KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 174KB - Virtual size: 174KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ