Static task
static1
Behavioral task
behavioral1
Sample
ba303e546bb494ba0e634e885ead844d_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
ba303e546bb494ba0e634e885ead844d_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
ba303e546bb494ba0e634e885ead844d_JaffaCakes118
-
Size
138KB
-
MD5
ba303e546bb494ba0e634e885ead844d
-
SHA1
a8cdcdaec66f69c80c637e7067c6830c700e97b7
-
SHA256
169bf33bc5cd543eea237d0b5027a3f5fb6803c02ce4dfa8aaa4ab795b0e591d
-
SHA512
d4a3e1d877718eb255c6864d8f32da4f612fa60a31467701985badb9080ef9a0c3876671bb92eec3a58a992f903f0e1fce5cac6dc302d4c560751974338c29d4
-
SSDEEP
3072:+nSNJa7n/VdpMmusBY1uMng1R7uV9FBnUxuJrTdkzGn0+AGGPY/T:+OQ/VdcsYa1R7+FxUxuKG0hDPe
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ba303e546bb494ba0e634e885ead844d_JaffaCakes118
Files
-
ba303e546bb494ba0e634e885ead844d_JaffaCakes118.exe windows:4 windows x86 arch:x86
f7176bb81943e0bc4f5da798f677df23
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
VirtualAlloc
GetSystemDefaultLangID
GetLogicalDrives
GetCurrentThread
GetModuleFileNameA
TlsAlloc
TlsGetValue
TlsFree
IsValidCodePage
GetCommandLineA
GetCurrentThreadId
GetDriveTypeA
GetThreadPriority
CloseHandle
Sleep
GetStartupInfoA
FreeLibrary
GetModuleHandleA
GetCurrentProcessId
GetCurrentProcess
TlsSetValue
user32
GetClassLongA
OpenIcon
GetDC
GetWindow
GetWindowTextA
UpdateWindow
GetFocus
GetWindowLongA
GetSystemMetrics
RegisterClassA
GetForegroundWindow
ShowWindow
CreateWindowExA
BeginPaint
GetWindowDC
GetWindowTextLengthA
IsWindowVisible
ReleaseDC
GetActiveWindow
advapi32
RegQueryValueExA
RegOpenKeyExA
RegCreateKeyExA
IsTextUnicode
RegCloseKey
GetUserNameA
version
GetFileVersionInfoSizeA
VerLanguageNameA
GetFileVersionInfoA
VerQueryValueA
Sections
.text Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 102KB - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE