Static task
static1
Behavioral task
behavioral1
Sample
a38ff53f0a0b1d0793d29747484e5fe7_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
a38ff53f0a0b1d0793d29747484e5fe7_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a38ff53f0a0b1d0793d29747484e5fe7_JaffaCakes118
-
Size
188KB
-
MD5
a38ff53f0a0b1d0793d29747484e5fe7
-
SHA1
abe1bf85d2b58e1ebe5607ea8b7c4dd18ceae0fd
-
SHA256
b0ee02104c203a56cf120b57f6f6374dd9a1dec14a3061547b3947f1e266b517
-
SHA512
3b7706d68a8114c5714b888ad72e926709396a43d0d59c3a7bdc38153f4082eec71f60ad43f49bfcc065dd5b5ada575e794625870435b2fdc8078e75ca51aa9e
-
SSDEEP
3072:pOechXbFytTUom+xfsehNV4o2JJ9wToBYK6tQyGg2LYGLP8:pOlbgtaxi0oc9wToz6GyGg2LYa
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a38ff53f0a0b1d0793d29747484e5fe7_JaffaCakes118
Files
-
a38ff53f0a0b1d0793d29747484e5fe7_JaffaCakes118.exe windows:4 windows x86 arch:x86
5c721b85bbc6a6d44886e87d9e52a80f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FormatMessageA
GetVersion
GetUserDefaultLangID
GetThreadTimes
GetLastError
GetCurrentThreadId
lstrlenA
GetCurrentDirectoryA
GetProcAddress
LoadLibraryA
IsBadReadPtr
GetNumberFormatA
GlobalAlloc
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GlobalFree
FlushFileBuffers
IsBadCodePtr
SetUnhandledExceptionFilter
GetOEMCP
GetACP
GetCPInfo
SetFilePointer
ReadFile
SetStdHandle
IsBadWritePtr
VirtualAlloc
WriteFile
VirtualFree
HeapCreate
HeapDestroy
GetStdHandle
SetHandleCount
SystemTimeToFileTime
lstrcmpA
GetCurrentThread
SetThreadPriority
SwitchToThread
GetStartupInfoA
MulDiv
OutputDebugStringA
CloseHandle
LoadLibraryW
Sleep
MultiByteToWideChar
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
RtlUnwind
GetModuleHandleA
GetCommandLineA
ExitProcess
HeapReAlloc
HeapAlloc
TerminateProcess
GetCurrentProcess
HeapSize
GetFileAttributesA
GetFileType
GetCurrentProcessId
HeapFree
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
RaiseException
user32
IsWindowEnabled
GetGUIThreadInfo
GetClassInfoW
GetSysColor
SetLastErrorEx
MessageBoxA
GetDesktopWindow
EnumChildWindows
LoadCursorFromFileA
GetCursorPos
SetCursorPos
FindWindowA
FlashWindow
LoadStringA
SetWindowTextA
IsCharAlphaA
RegisterHotKey
PeekMessageA
GetDC
GetWindowTextLengthA
GetWindowTextA
PostMessageA
CopyImage
gdi32
Escape
DeleteObject
CreatePen
GetDeviceCaps
CreateFontA
CreateEllipticRgn
SetBkMode
SelectObject
advapi32
OpenThreadToken
GetTokenInformation
shlwapi
PathGetCharTypeA
PathAppendA
PathIsSameRootA
Sections
.text Size: 48KB - Virtual size: 48KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 125KB - Virtual size: 153KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
lqnoakb Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE