Static task
static1
Behavioral task
behavioral1
Sample
a1e7c33fe432227b143d4d323d02d052_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
a1e7c33fe432227b143d4d323d02d052_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a1e7c33fe432227b143d4d323d02d052_JaffaCakes118
-
Size
163KB
-
MD5
a1e7c33fe432227b143d4d323d02d052
-
SHA1
3458f78502d24f388e7ceda2142d0220423a9262
-
SHA256
bda9b4e62c24f321f17999dbffc78940f015e748bdabf63a51e5d8bae6af85b5
-
SHA512
e1eed56e1e77d26e3a634aea1c59691637c3febddf6b0e1821127bb3d47ef920aa25b9672e16d1d8b2d5c0c3ef30aebcbbc64a113140f8ce27a020915e0660b9
-
SSDEEP
3072:wKqt9PaTlFGcNl1a1llABigK1c/H/3ugN6JpjYiECdRK98wf5TEYCI1:obiKcn1a1ll021c/f+aUNYiECLXkZh
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a1e7c33fe432227b143d4d323d02d052_JaffaCakes118
Files
-
a1e7c33fe432227b143d4d323d02d052_JaffaCakes118.exe windows:4 windows x86 arch:x86
c657d7102ae7cf26093fc026300d50a5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
UrlCanonicalizeW
UrlCombineW
UrlApplySchemeW
UrlGetPartW
PathCombineW
PathAppendW
oleacc
LresultFromObject
AccessibleObjectFromEvent
kernel32
InterlockedCompareExchange
CloseHandle
WideCharToMultiByte
LoadLibraryW
HeapFree
GetLocaleInfoA
GetStartupInfoA
GetCurrentProcessId
GetProcessHeap
TerminateProcess
Sleep
GetACP
lstrlenW
GetTickCount
GetSystemTimeAsFileTime
GetStdHandle
WriteFile
GetSystemTime
lstrlenA
EnumResourceTypesW
UnhandledExceptionFilter
SystemTimeToFileTime
SetUnhandledExceptionFilter
GetThreadLocale
MultiByteToWideChar
IsDebuggerPresent
GetEnvironmentVariableA
LoadLibraryExW
InterlockedExchange
HeapReAlloc
HeapFree
HeapSize
RaiseException
ResetWriteWatch
GetModuleHandleA
CreateFileW
HeapAlloc
GetCurrentProcess
GetCurrentThreadId
CreateProcessA
QueryPerformanceCounter
HeapDestroy
LocalAlloc
lstrcpynW
msimg32
TransparentBlt
wtsapi32
WTSFreeMemory
WTSUnRegisterSessionNotification
WTSQuerySessionInformationW
WTSEnumerateSessionsW
WTSRegisterSessionNotification
Sections
.text Size: 65KB - Virtual size: 65KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 401KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 94KB - Virtual size: 94KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ