Static task
static1
Behavioral task
behavioral1
Sample
94d00b0ea3c0fc69c52f761efcb49c0c_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
94d00b0ea3c0fc69c52f761efcb49c0c_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
94d00b0ea3c0fc69c52f761efcb49c0c_JaffaCakes118
-
Size
1.5MB
-
MD5
94d00b0ea3c0fc69c52f761efcb49c0c
-
SHA1
3f30f4039821132889717694c664c3bfac805f1a
-
SHA256
32c35535fa6c1f2ad65f595c9459833294628e1bcff9f09105f686b833210ad8
-
SHA512
e466c2317b92cc732cc31c0e1f0fb44bb5d99f9845fed48dac52f96b103775d64be477611afdc83307555b32604a62609d6a14111a0989a09ab1d61fb1398ce5
-
SSDEEP
24576:v51m0V5yLgIdvxUANFUGVoU733D4A5mr2GXa27yzqjcaDvmnSAz2+LQshKE6fclg:fm1GANFLoS/WTK27qsmnIE6mndCYUd
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 94d00b0ea3c0fc69c52f761efcb49c0c_JaffaCakes118
Files
-
94d00b0ea3c0fc69c52f761efcb49c0c_JaffaCakes118.exe windows:4 windows x86 arch:x86
b2ece0e6a36415629e5534842e73443b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WinExec
HeapSize
VerifyConsoleIoHandle
GlobalUnfix
CreateThread
SetFileApisToANSI
Toolhelp32ReadProcessMemory
HeapLock
InterlockedDecrement
_lopen
WritePrivateProfileStringW
GetThreadSelectorEntry
HeapWalk
DebugBreak
user32
GetSystemMetrics
GetKeyboardLayoutNameA
ModifyMenuA
MessageBoxIndirectA
GetTopWindow
DdeClientTransaction
SetProcessWindowStation
CopyAcceleratorTableA
SendNotifyMessageA
GetCapture
shell32
SHFileOperation
gdi32
XFORMOBJ_bApplyXform
CreatePolygonRgn
AddFontResourceW
SetViewportOrgEx
CreateFontIndirectA
PatBlt
GdiEntry14
GetLogColorSpaceW
PATHOBJ_vGetBounds
Sections
CODE Size: 9KB - Virtual size: 188KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 36KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 2KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pack32 Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE