Static task
static1
Behavioral task
behavioral1
Sample
b406ba165b8500f3828687dcf14a0165_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
b406ba165b8500f3828687dcf14a0165_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
b406ba165b8500f3828687dcf14a0165_JaffaCakes118
-
Size
242KB
-
MD5
b406ba165b8500f3828687dcf14a0165
-
SHA1
79f2490dd858807ecf00749bc8341c04a203370d
-
SHA256
594c467e38874bc9b39adfad370de12f425f17bcf8877b6175c113fa094b2ee4
-
SHA512
65443cfcafd2b0a799f7907ffb61c2e1d0e1fb809fd665c6c6c29186d99ce01a449f7b543efc6a9b1a533273f790e70eb2c7f19557feec404aa0df7ac316beac
-
SSDEEP
6144:68nunPuGRppmMxomdvtf17FLYnzOy0FHChI7YZ:68ipQM/dvtxOnCLChI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b406ba165b8500f3828687dcf14a0165_JaffaCakes118
Files
-
b406ba165b8500f3828687dcf14a0165_JaffaCakes118.exe windows:4 windows x86 arch:x86
49149400f635ee93ad9f9dedeadb4992
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetACP
GetSystemDefaultLangID
GetCurrentProcess
lstrcmpA
GetModuleFileNameA
GetCommandLineA
IsDBCSLeadByte
GetCurrentProcessId
VirtualAlloc
GetSystemDefaultLCID
TlsAlloc
GetCurrentThread
TlsFree
GetLogicalDrives
GetModuleHandleW
GetDriveTypeW
lstrcatA
FreeLibrary
TlsSetValue
TlsGetValue
GetCurrentThreadId
user32
GetSystemMetrics
GetWindowTextA
GetWindowDC
GetDC
GetWindowLongA
ReleaseDC
CreateWindowExA
UpdateWindow
ShowWindow
BeginPaint
IsWindowVisible
GetForegroundWindow
GetWindow
GetClassLongA
GetWindowTextLengthA
IsIconic
GetActiveWindow
GetFocus
RegisterClassA
gdi32
GetStockObject
SelectObject
SetBkMode
GetObjectA
DeleteObject
SetTextColor
clbcatq
ComPlusMigrate
DowngradeAPL
SetSetupOpen
SetSetupSave
Sections
.text Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 368KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ