Static task
static1
Behavioral task
behavioral1
Sample
b46b4e737b5af3b6d7af1b36d6047195_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
b46b4e737b5af3b6d7af1b36d6047195_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
b46b4e737b5af3b6d7af1b36d6047195_JaffaCakes118
-
Size
101KB
-
MD5
b46b4e737b5af3b6d7af1b36d6047195
-
SHA1
03f408b9ba4c858b47b019e01467e7083cef9006
-
SHA256
e393705c08e33395184a5061b155697dd34359d8aaaef0cdec4127fcb031da3a
-
SHA512
1eceecd1cd9e35d417f87a4c26e60dfb45c5c02050c38acf326e8a0fd50dec893ff4a952219bed68f561c0bc9f96c874ef6759c4e9a06c9c7a204139dc46c059
-
SSDEEP
1536:7P4mQ+W4hKwHCtjeWQuhrzb8yUNKAbbzCwHzx5e6ywv77St+iyYzdzRvD3:7Pil4YXBFmxN/fXx5ehwSt+iyYdztD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b46b4e737b5af3b6d7af1b36d6047195_JaffaCakes118
Files
-
b46b4e737b5af3b6d7af1b36d6047195_JaffaCakes118.exe windows:4 windows x86 arch:x86
58396278981f03d92abc91a89f450298
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
comdlg32
GetFileTitleA
GetSaveFileNameA
GetOpenFileNameA
FindTextA
ChooseColorA
shell32
SHGetSpecialFolderLocation
SHGetDiskFreeSpaceA
SHFileOperationA
version
VerFindFileA
comctl32
ImageList_DrawEx
ImageList_Remove
ImageList_Read
ImageList_Create
ImageList_DragShowNolock
ImageList_GetBkColor
ImageList_Write
user32
EnumChildWindows
IsWindowEnabled
DispatchMessageW
SystemParametersInfoA
IsChild
IsWindowVisible
GetScrollInfo
ActivateKeyboardLayout
AdjustWindowRectEx
GetCursor
gdi32
CreateDIBitmap
GetBitmapBits
kernel32
GetCommandLineA
ExitThread
VirtualFree
VirtualQuery
EnumCalendarInfoA
GetModuleHandleA
FreeLibrary
GetLocalTime
SetHandleCount
GetOEMCP
CompareStringA
VirtualAlloc
HeapAlloc
MoveFileExA
lstrlenA
lstrcpynA
SetLastError
GetACP
SetEndOfFile
GetTickCount
GetProcAddress
VirtualAllocEx
LocalAlloc
HeapFree
Sections
.text Size: 22KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 1024B - Virtual size: 678B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
BSS Size: 77KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE