Static task
static1
Behavioral task
behavioral1
Sample
b5a7d5766a3eda44eaef3dca8c6b631b_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
b5a7d5766a3eda44eaef3dca8c6b631b_JaffaCakes118
-
Size
186KB
-
MD5
b5a7d5766a3eda44eaef3dca8c6b631b
-
SHA1
55f782438dba26ad37186748793d596416ad1c89
-
SHA256
4eb0e4ead48458277cd6d278078d2d56423e20fc387371cf8200d4a8583d30af
-
SHA512
560e48210a8b231600fcfc0e80c21ce708b6e3a6d8ec5ac0d2f38e2f03e64b18057f0aea456e10123eb6641e14892f81dc0fa4736151df76a36c1bf35100e31b
-
SSDEEP
3072:xARe5XoQbB29ldcXFVt+zfitYFAHgZZ8gOvM9osz8wDwVVdSh+2u6bKUXOrA:+Re5XNkeFVdgZZ8gOvUCi6dh2B
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b5a7d5766a3eda44eaef3dca8c6b631b_JaffaCakes118
Files
-
b5a7d5766a3eda44eaef3dca8c6b631b_JaffaCakes118.exe windows:4 windows x86 arch:x86
da6f42502f0c630244e05196f294be00
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
newdev
UpdateDriverForPlugAndPlayDevicesW
setupapi
CM_Get_Parent
SetupDiGetDeviceRegistryPropertyW
CMP_WaitNoPendingInstallEvents
CM_Get_DevNode_Status
shell32
SHGetFolderPathW
mprapi
MprConfigServerDisconnect
MprConfigServerConnect
MprConfigGetFriendlyName
kernel32
GetLocaleInfoA
GetCPInfo
HeapCreate
TlsGetValue
AddAtomA
GetCurrentProcess
GetSystemTimeAsFileTime
SetEndOfFile
HeapSize
TlsFree
VirtualQuery
GetStartupInfoA
GetSystemInfo
GetEnvironmentStrings
TerminateProcess
InterlockedExchange
IsBadWritePtr
SetHandleCount
GetFileType
GetACP
EnumResourceLanguagesA
GetVersionExA
GetModuleFileNameA
FreeEnvironmentStringsA
GetOEMCP
UnhandledExceptionFilter
GetStdHandle
GetEnvironmentStringsW
WriteFile
lstrcpynW
SetLastError
HeapDestroy
GetCurrentProcessId
VirtualFree
VirtualAlloc
TlsSetValue
FreeEnvironmentStringsW
TlsAlloc
QueryPerformanceCounter
SetUnhandledExceptionFilter
iphlpapi
GetIpAddrTable
user32
CreateWindowExW
EnumChildWindows
DestroyWindow
GetDlgItem
SendMessageA
IsWindow
GetWindowThreadProcessId
Sections
.text Size: 99KB - Virtual size: 242KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 83KB - Virtual size: 83KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ