Static task
static1
Behavioral task
behavioral1
Sample
bf6baa424c17c03f76635ab4469381b4_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
bf6baa424c17c03f76635ab4469381b4_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
bf6baa424c17c03f76635ab4469381b4_JaffaCakes118
-
Size
102KB
-
MD5
bf6baa424c17c03f76635ab4469381b4
-
SHA1
1ef2697bf7915fc5421283f1a9a38b0f77db374b
-
SHA256
cc15f80dac1d2aef6ffff85bd415d81c859c857acbc6ea2bc377e938426b45bc
-
SHA512
6778d56057ab3772cb9d3d5f7f7ab09410e87b080de32dcb7fb891591ef0d52bab6e7f74844b7f6fbccd400ebd461ee520084554b13a73899db0bd6d9431bca4
-
SSDEEP
3072:xEnbi5KXJc+tBAmAbzOaOZ6bftGPTnVMgSsF+:xobTJlYPUZktS7Cgh
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bf6baa424c17c03f76635ab4469381b4_JaffaCakes118
Files
-
bf6baa424c17c03f76635ab4469381b4_JaffaCakes118.exe windows:4 windows x86 arch:x86
d71bad320a9932485a4bd7ba61f7536f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
__setusermatherr
__getmainargs
_XcptFilter
strcmp
_except_handler3
printf
exit
_acmdln
fflush
_exit
calloc
free
__p__commode
_adjust_fdiv
_initterm
__p__fmode
__set_app_type
kernel32
LocalFree
GetProcAddress
CreateFileMappingA
lstrlenA
VirtualProtectEx
GetVersionExW
GetCurrentDirectoryA
LoadLibraryExW
GetModuleHandleW
SetFilePointer
user32
ShowCursor
PeekMessageA
TrackPopupMenu
GetFocus
InsertMenuA
RegisterClassA
ole32
CoRegisterMessageFilter
IsAccelerator
CoFreeUnusedLibraries
IIDFromString
OleIsCurrentClipboard
OleFlushClipboard
PropVariantClear
StringFromIID
advapi32
ControlService
SetSecurityDescriptorGroup
OpenThreadToken
OpenSCManagerW
shell32
SHFileOperationW
SHFileOperationA
SHGetMalloc
ExtractIconExA
ExtractAssociatedIconW
SHGetFileInfoA
ShellExecuteExW
CommandLineToArgvW
comctl32
ImageList_BeginDrag
ImageList_GetIconSize
ImageList_LoadImageA
ImageList_GetImageInfo
oleaut32
VariantInit
SysAllocStringByteLen
VariantCopyInd
SafeArrayPtrOfIndex
CreateErrorInfo
SetErrorInfo
SafeArrayPutElement
gdi32
Ellipse
PtVisible
StrokeAndFillPath
DPtoLP
Sections
.text Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 37KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 58KB - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ