Static task
static1
Behavioral task
behavioral1
Sample
bcf1bcf0c00c0dfaab8fa6fac78ac151_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
bcf1bcf0c00c0dfaab8fa6fac78ac151_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
bcf1bcf0c00c0dfaab8fa6fac78ac151_JaffaCakes118
-
Size
114KB
-
MD5
bcf1bcf0c00c0dfaab8fa6fac78ac151
-
SHA1
3547833cfd1f17e999678e4a7b9528514b3bb236
-
SHA256
2e349102f1c045cd96611eb44511edd69cde6298b318878d9b02dc1113418190
-
SHA512
5598efe4e014a925a9fb72c8e592b6e10aabd8bde4d37153ae7e501e571bd087a487fc943a015d83fa9920d5c8f80f0a3c553c1fe3a1e27e4ffe6375a81a1ca0
-
SSDEEP
1536:r08c9HDB2fxuEa8oYWMrzcsyRri70n1X5lUeEOaz2HtNGxnmIpY3TCMl1cwJYqzo:Acx9rw5RhXEeEWHtNGxnmICCMbRo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bcf1bcf0c00c0dfaab8fa6fac78ac151_JaffaCakes118
Files
-
bcf1bcf0c00c0dfaab8fa6fac78ac151_JaffaCakes118.exe windows:4 windows x86 arch:x86
27478ad28e8dccc21f85dac60c690321
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetDriveTypeA
GetThreadLocale
MulDiv
GetCommandLineW
lstrcmpiA
DeleteFileW
GetModuleHandleW
IsDebuggerPresent
GetCurrentProcessId
lstrcmpiW
GetUserDefaultLangID
lstrlenW
GetStartupInfoA
QueryPerformanceCounter
GetCommandLineA
GetProcessHeap
GlobalFindAtomA
GetModuleHandleA
DeleteFileA
GetOEMCP
GetCurrentThreadId
GetTickCount
GlobalFindAtomW
lstrlenA
CopyFileA
RemoveDirectoryA
GetACP
GetCurrentProcess
lstrcmpA
GetVersion
GetConsoleOutputCP
GetCurrentThread
GetWindowsDirectoryA
SetCurrentDirectoryA
VirtualAlloc
VirtualFree
RemoveDirectoryW
gdi32
GetClipBox
CreatePen
SelectObject
SetMapMode
CreateCompatibleDC
CreateSolidBrush
SetTextColor
DeleteObject
GetObjectA
LineTo
DeleteDC
CreatePalette
SetStretchBltMode
GetTextMetricsA
RestoreDC
GetStockObject
GetPixel
SetTextAlign
CreateFontIndirectA
PatBlt
GetDeviceCaps
SelectPalette
RectVisible
SaveDC
SetPixel
user32
CharNextA
GetSystemMetrics
GetDesktopWindow
GetParent
TranslateMessage
glu32
gluQuadricCallback
Sections
.text Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 80KB - Virtual size: 79KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ