Static task
static1
Behavioral task
behavioral1
Sample
8e6cf9ffeda57247c255338a76e26fdc_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
8e6cf9ffeda57247c255338a76e26fdc_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
8e6cf9ffeda57247c255338a76e26fdc_JaffaCakes118
-
Size
167KB
-
MD5
8e6cf9ffeda57247c255338a76e26fdc
-
SHA1
76e715d35e302a07610b5a26548ae39409073970
-
SHA256
6fc8a500a6776342b1347780fbf9f88786620de3c8833dd15653e5a417ed916c
-
SHA512
dd84065d84cf4bab1f831b3ec4befc22dbe4bacf45be9d49fad7694c42364f50afbbddc05faae893917acfda6d5c61c10acfa7966d7bf108df38d1b870966e56
-
SSDEEP
3072:TEyptP8q3gUQB/Zk4/4PBB+jCFjpS5MZEbJOP:TV3RQB/C4/4PBBBjpCM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8e6cf9ffeda57247c255338a76e26fdc_JaffaCakes118
Files
-
8e6cf9ffeda57247c255338a76e26fdc_JaffaCakes118.exe windows:5 windows x86 arch:x86
998d5f291f0e1a8706b5bed678fc3611
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetOEMCP
GlobalFindAtomW
GetConsoleOutputCP
GetThreadLocale
CopyFileA
DeleteFileA
GetCommandLineA
QueryPerformanceCounter
lstrcmpiW
GlobalFindAtomA
GetModuleHandleW
GetUserDefaultLangID
GetCurrentThread
lstrlenA
RemoveDirectoryA
GetWindowsDirectoryA
lstrlenW
GetModuleHandleA
GetDriveTypeA
GetProcessHeap
GetCurrentThreadId
MulDiv
GetVersion
IsDebuggerPresent
GetCommandLineW
GetCurrentProcessId
GetACP
lstrcmpA
SetCurrentDirectoryA
GetTickCount
GetStartupInfoA
GetCurrentProcess
lstrcmpiA
DeleteFileW
VirtualAlloc
VirtualFree
user32
GetDesktopWindow
GetParent
GetDC
CharNextA
TranslateMessage
GetSystemMetrics
gdi32
PatBlt
RectVisible
CreateCompatibleDC
CreateSolidBrush
CreatePen
SetMapMode
GetPixel
SetTextAlign
SelectPalette
SetTextColor
RestoreDC
SetStretchBltMode
DeleteDC
GetTextMetricsA
SelectObject
LineTo
CreateFontIndirectA
SaveDC
GetDeviceCaps
GetObjectA
GetClipBox
CreatePalette
DeleteObject
GetStockObject
glu32
gluNurbsCallback
Sections
.text Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Kngbnsww Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Aoev Yfe Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 100KB - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ