__GetExceptDLLinfo
Static task
static1
Behavioral task
behavioral1
Sample
be665a5ebd8ff99dfdfcb08b0de79f78_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
be665a5ebd8ff99dfdfcb08b0de79f78_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
be665a5ebd8ff99dfdfcb08b0de79f78_JaffaCakes118
-
Size
1.1MB
-
MD5
be665a5ebd8ff99dfdfcb08b0de79f78
-
SHA1
d62437cbb98ba68d7392157c476ecdce9c53f33f
-
SHA256
3fcd4ee2a1903328f53d11c960451768ea280f601661d96a9221576241fe4ec4
-
SHA512
96f63328e1627515e9e255d1e83d43bf3dbb0cdd661dc3d21d804c43f9a28a53e34e124adb4dc2e8c18f89344aee12bf99a01ff17b678817b968bdd247c88960
-
SSDEEP
24576:SstRgkGtuRsKnz3v4FAO5mfVOSRNd6um+Ui6a1MfxQg9e5HvTS4mxl:ttukGtuFz3bO5mfVfeFfxZ9eFGdxl
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource be665a5ebd8ff99dfdfcb08b0de79f78_JaffaCakes118
Files
-
be665a5ebd8ff99dfdfcb08b0de79f78_JaffaCakes118.exe windows:1 windows x86 arch:x86
fdc61f3320af27b5a2c66e69e42ad3a8
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
CloseHandle
FindResourceA
LoadResource
GetEnvironmentStrings
SetFilePointer
GetModuleHandleA
WritePrivateProfileStringA
VirtualFree
GetFileSize
GlobalLock
GetSystemDirectoryA
GetShortPathNameA
SearchPathA
LockResource
lstrcpyA
GetWindowsDirectoryA
GlobalFree
GetVersion
CreateFileA
GlobalUnlock
GlobalMemoryStatus
WriteFile
GetCommandLineA
VirtualAlloc
Sleep
SizeofResource
GetCurrentDirectoryA
DeleteFileA
GetProcAddress
ReadFile
ExitProcess
GetDiskFreeSpaceA
GlobalAlloc
lstrcatA
gdi32
StretchDIBits
SelectPalette
SelectObject
GetTextExtentPoint32A
GetStockObject
GetDeviceCaps
DeleteObject
RealizePalette
CreatePalette
user32
LoadStringA
LoadIconA
LoadCursorA
GetMessageA
GetDC
GetClientRect
EndPaint
DispatchMessageA
DestroyWindow
DefWindowProcA
GetActiveWindow
CreateWindowExA
CreateDialogParamA
BeginPaint
GetSystemMetrics
UpdateWindow
SystemParametersInfoA
ShowWindow
MessageBoxA
SendMessageA
ReleaseDC
RegisterClassA
PostQuitMessage
MoveWindow
TranslateMessage
lz32
LZOpenFileA
LZCopy
LZClose
shell32
ShellExecuteA
Exports
Exports
Sections
CODE Size: 11KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ