Static task
static1
Behavioral task
behavioral1
Sample
a178b0a01a5eed9b13400592b06225da_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
a178b0a01a5eed9b13400592b06225da_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a178b0a01a5eed9b13400592b06225da_JaffaCakes118
-
Size
2.0MB
-
MD5
a178b0a01a5eed9b13400592b06225da
-
SHA1
5a14f3ac79f7e2031bbf8c8e148f7c041440c44f
-
SHA256
b7545dc2636a5072e18f61b21617f8bd621d8be8af677b5aa3f36d09391a1b18
-
SHA512
052f9e92fcc44f96ad16b126b4598b9fcb48e1c9d226131482c7ac102312960cfc34b2c1fb6b721bbf79a68c34780189d14131c203982c3ac076fdc3fcdfae70
-
SSDEEP
49152:1nj2qUoLK3nIGf2GPXNWTwv1vxfrmiWIFcvlPHsBr:1j2f3nF2GPBjf7c9ver
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a178b0a01a5eed9b13400592b06225da_JaffaCakes118
Files
-
a178b0a01a5eed9b13400592b06225da_JaffaCakes118.exe windows:4 windows x86 arch:x86
85ad38d84878967c9883e597ed5d9777
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ExitProcess
WritePrivateProfileStringA
GetDriveTypeW
DebugBreak
ConnectNamedPipe
SetConsoleMode
DeleteFiber
GetShortPathNameA
SetThreadAffinityMask
EnumCalendarInfoA
FatalAppExitA
GlobalFindAtomW
MoveFileW
FillConsoleOutputCharacterA
GetDiskFreeSpaceExA
EnumSystemCodePagesW
OutputDebugStringW
DosDateTimeToFileTime
WritePrivateProfileStringW
ReleaseSemaphore
EnumCalendarInfoW
IsProcessorFeaturePresent
GetDateFormatA
ole32
OleGetIconOfClass
PropVariantCopy
CoReleaseMarshalData
CoResumeClassObjects
version
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA
user32
InternalGetWindowText
GetMenuItemRect
DefDlgProcW
EnumWindowStationsW
SetSysColors
SetWindowLongA
GetAsyncKeyState
CharPrevW
GetWindowDC
SetMenuItemInfoW
DialogBoxParamA
TabbedTextOutW
ArrangeIconicWindows
LoadImageA
RegisterClipboardFormatW
GetClassInfoW
FrameRect
GetShellWindow
OemToCharBuffW
SetCapture
IsCharAlphaW
GetUpdateRgn
DefFrameProcW
SetProcessDefaultLayout
MapVirtualKeyExW
InflateRect
GetAncestor
MonitorFromRect
GetKeyboardLayout
WinHelpA
SendDlgItemMessageA
ws2_32
htonl
gethostname
WSAUnhookBlockingHook
getprotobyname
shutdown
WSAGetQOSByName
recv
inet_addr
getsockname
WSAInstallServiceClassW
oleaut32
VariantCopy
Sections
.text Size: 11KB - Virtual size: 227KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ