Static task
static1
Behavioral task
behavioral1
Sample
be527dfc1bca1779ea683c09fa8de521_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
be527dfc1bca1779ea683c09fa8de521_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
be527dfc1bca1779ea683c09fa8de521_JaffaCakes118
-
Size
316KB
-
MD5
be527dfc1bca1779ea683c09fa8de521
-
SHA1
1fd692b62414f72b7cf16e0c9d9cbe1396468fc3
-
SHA256
c9ac15c3c1cdbac94dbf64b2c8cef5c2b859f1c18b076d91d4c8075177052f42
-
SHA512
e9ebd4045619ae06080bc8b73bb9248c37149a7cd46a862ae61673ccbe28f093b7789ed48e3e6b8940c5a706c562a9ec9b9c1818ed11fcf7214f79f63479ef27
-
SSDEEP
6144:QGMdxELT74WguP7eJ85VlGerWGFSu8p6M3CxQuYZTbPQnodj519ZEA:QGKxEv741uPCc+Gou8VZvPLD5EA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource be527dfc1bca1779ea683c09fa8de521_JaffaCakes118
Files
-
be527dfc1bca1779ea683c09fa8de521_JaffaCakes118.exe windows:4 windows x86 arch:x86
fe4ab11e3273c82943f97651c423d004
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetTickCount
GetAtomNameA
GetEnvironmentVariableA
GetVersion
GetModuleHandleW
Sleep
SetCommMask
lstrcmpA
ExitProcess
GetLongPathNameW
ExpandEnvironmentStringsW
SetSystemTime
GetModuleHandleA
GetCurrentThread
GetProcessAffinityMask
GetCurrentProcess
VirtualAlloc
WideCharToMultiByte
GetTempPathW
GetProcessHeap
GetLastError
SetThreadAffinityMask
GetCurrentThreadId
GetACP
Process32FirstW
Module32First
GetCommandLineA
GetModuleFileNameA
GetCurrentProcessId
OpenFileMappingA
GetCommandLineW
SetConsoleCP
iashlpr
ShutdownIas
DoRequest
AllocateAttributes
MemFreeIas
FreeAttributes
msvcrt
_setjmp
_lseeki64
iswcntrl
__p__iob
fgetpos
??0exception@@QAE@XZ
_execl
__p__osver
_wpopen
_access
rand
towlower
_chdir
exit
user32
ShowOwnedPopups
CharToOemA
WaitMessage
GetDC
GetMessageTime
GrayStringW
GetWindowTextA
DialogBoxIndirectParamAorW
GetSystemMetrics
PrivateExtractIconsW
msi
ord173
ord145
ord32
ord121
ord51
ord92
ord66
ord19
ord17
ord175
ord228
ord103
ord81
Sections
.text Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.textbs Size: 155KB - Virtual size: 225KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DATA Size: 134KB - Virtual size: 209KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ