Static task
static1
Behavioral task
behavioral1
Sample
bd29272c45d23f965daae15ff6dcafe0_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
bd29272c45d23f965daae15ff6dcafe0_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
bd29272c45d23f965daae15ff6dcafe0_JaffaCakes118
-
Size
660KB
-
MD5
bd29272c45d23f965daae15ff6dcafe0
-
SHA1
c99177e1b89f969a5fefc45d69d799df1857ad44
-
SHA256
abb47613277955bef88e3f2868718e1d528dee95f2080f8747e9d32584d3a64d
-
SHA512
38d56a1293d93449840abf7d7728b16551626e8fef84fea8c1ad4166b7f4e9730619059acd8bc97b6f53126e31756019292553a95ed295366d535e374b82dcf4
-
SSDEEP
12288:D73TmvxYNpHmqNh3cj4mISrGOnBOocpDUCuCqWr5s5y7ZxM02UdSRLJa4gMM:D7KxYNoqNh3cchSlnB7YqWr3A1UkRdaP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bd29272c45d23f965daae15ff6dcafe0_JaffaCakes118
Files
-
bd29272c45d23f965daae15ff6dcafe0_JaffaCakes118.exe windows:5 windows x86 arch:x86
d1a4deec27a03daadb54f47065ef3edd
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegDeleteValueA
user32
ScreenToClient
SetForegroundWindow
MoveWindow
PostQuitMessage
SetWindowPos
DispatchMessageA
ClientToScreen
GetDC
SendMessageA
DestroyWindow
UpdateWindow
ShowWindow
EnableWindow
PeekMessageA
TranslateMessage
EnableMenuItem
GetWindowLongA
SetTimer
FillRect
EndPaint
SetFocus
BeginPaint
KillTimer
DefWindowProcA
GetSystemMetrics
GetWindowRect
PostMessageA
SetWindowLongA
SetWindowTextA
wsprintfA
CreateWindowExA
GetDesktopWindow
EndDialog
MessageBoxA
SystemParametersInfoA
InvalidateRect
GetClientRect
GetDlgItem
kernel32
GetFileSize
RtlUnwind
GetEnvironmentVariableA
GetStdHandle
GetConsoleOutputCP
FileTimeToSystemTime
GetFileAttributesA
WaitForSingleObject
HeapDestroy
GetFileAttributesW
FreeEnvironmentStringsA
DeleteCriticalSection
GetCurrentProcess
GetCurrentDirectoryA
LocalAlloc
SetErrorMode
FreeEnvironmentStringsW
SetStdHandle
WideCharToMultiByte
GetStringTypeA
WriteFile
VirtualAlloc
FindResourceA
Sleep
VirtualFree
HeapCreate
CreateProcessA
SizeofResource
InterlockedExchange
GetVersion
GetModuleHandleW
GlobalLock
GetACP
CloseHandle
ReadFile
SetFilePointer
TlsFree
RaiseException
InterlockedCompareExchange
GetCommandLineA
HeapSize
GetCPInfo
GetCommandLineW
LockResource
GetCurrentProcessId
GetEnvironmentStrings
FileTimeToLocalFileTime
lstrlenW
GlobalUnlock
GetEnvironmentStringsW
GetThreadLocale
LCMapStringA
GetConsoleCP
lstrlenA
LCMapStringW
GetLastError
InterlockedIncrement
ExitProcess
CreateFileA
TlsSetValue
GetFileType
CreateEventW
WaitForMultipleObjects
DuplicateHandle
FindNextFileA
GetSystemTimeAsFileTime
FindNextFileW
GetProcessHeap
GetProcAddress
SetEvent
DeleteFileA
CompareStringA
GetStartupInfoA
LoadLibraryA
FlushFileBuffers
TlsAlloc
GetTickCount
QueryPerformanceCounter
GetOEMCP
LoadLibraryW
SetHandleCount
EnterCriticalSection
HeapFree
WriteConsoleW
LeaveCriticalSection
GetCurrentThreadId
SetEndOfFile
GlobalAlloc
TerminateProcess
SetEnvironmentVariableA
MulDiv
SetUnhandledExceptionFilter
CreateThread
GetModuleHandleA
GetLocalTime
MultiByteToWideChar
UnhandledExceptionFilter
GetPrivateProfileStringA
GetModuleFileNameA
GetVersionExA
HeapAlloc
IsDebuggerPresent
GetModuleFileNameW
GetLocaleInfoA
TlsGetValue
SetLastError
FormatMessageA
InterlockedDecrement
FindClose
LoadResource
InitializeCriticalSection
LocalFree
FreeLibrary
GetStringTypeW
HeapReAlloc
gdi32
BitBlt
SetBkColor
DeleteDC
SetTextColor
CreateSolidBrush
SetBkMode
Sections
.text Size: 24KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 608KB - Virtual size: 604KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ