Static task
static1
Behavioral task
behavioral1
Sample
c00ca53f3e83a030570b5a71fd72877c_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
c00ca53f3e83a030570b5a71fd72877c_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
c00ca53f3e83a030570b5a71fd72877c_JaffaCakes118
-
Size
181KB
-
MD5
c00ca53f3e83a030570b5a71fd72877c
-
SHA1
11e96555eb06fe73007fe0d2e23a0800dd79494a
-
SHA256
02aa46cb1abc78123490bb7e8d87bedd53f6bbf2022a4ab591f30db7004decdf
-
SHA512
955a38dcc3e0a8d78fc788adc4eee37f9f96813f398e3fef5091bf2ceb28a50b7186718203475f45ffcd55dc3759d7ca66e7e7200828765ddfba3c7662f95c4d
-
SSDEEP
3072:m4WNxWRcMUtokR1mGdu1C5VJYeasQTBfhuLqTcQdm7dd3cs:yxXYjbC5rBQTBZuLq1d4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c00ca53f3e83a030570b5a71fd72877c_JaffaCakes118
Files
-
c00ca53f3e83a030570b5a71fd72877c_JaffaCakes118.exe windows:4 windows x86 arch:x86
e426343d5a4de9805fb04ab986b9dfb1
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
memset
_strnicmp
strncmp
strncpy
_strdup
free
strcmp
memmove
strlen
strcpy
strcat
memcpy
fread
longjmp
_setjmp3
sprintf
fabs
ceil
malloc
floor
fclose
abort
_snprintf
__p__iob
fprintf
_CIpow
strtod
kernel32
GetModuleHandleA
HeapCreate
HeapDestroy
ExitProcess
GetDriveTypeA
GetVolumeInformationA
EnterCriticalSection
WaitForSingleObject
LeaveCriticalSection
InitializeCriticalSection
CloseHandle
CreateThread
GetModuleFileNameA
GetCurrentProcess
DuplicateHandle
CreatePipe
GetStdHandle
HeapAlloc
CreateProcessA
HeapFree
Sleep
SetLastError
LoadLibraryA
GetProcAddress
FreeLibrary
GetVersionExA
GlobalAlloc
GlobalFree
TlsAlloc
MulDiv
FindFirstFileA
FindClose
GetFileAttributesA
DeleteFileA
WriteFile
CreateFileA
ReadFile
SetFilePointer
GetFileSize
HeapReAlloc
TlsGetValue
TlsSetValue
DeleteCriticalSection
InterlockedCompareExchange
InterlockedExchange
WaitForMultipleObjects
GetCurrentThreadId
GetCurrentThread
CreateSemaphoreA
ReleaseSemaphore
user32
MessageBoxA
DestroyWindow
SendMessageA
GetWindowRect
ScreenToClient
RedrawWindow
GetWindowLongA
GetIconInfo
SetWindowPos
InvalidateRect
UpdateWindow
ReleaseCapture
BeginPaint
DrawStateA
EndPaint
SetCapture
CallWindowProcA
GetSystemMetrics
CreateWindowExA
SetWindowLongA
GetSysColor
GetSysColorBrush
IsWindowEnabled
GetWindowTextLengthA
GetWindowTextA
SetWindowTextA
RemovePropA
DefWindowProcA
SetPropA
GetParent
GetPropA
GetWindow
SetActiveWindow
UnregisterClassA
DestroyAcceleratorTable
LoadIconA
LoadCursorA
RegisterClassA
AdjustWindowRectEx
GetActiveWindow
ShowWindow
CreateAcceleratorTableA
SetCursorPos
LoadImageA
SetCursor
MapWindowPoints
MoveWindow
SystemParametersInfoA
GetKeyState
PostMessageA
GetCursorPos
SetFocus
GetFocus
GetClientRect
FillRect
EnumChildWindows
DefFrameProcA
PeekMessageA
MsgWaitForMultipleObjects
GetMessageA
TranslateAcceleratorA
TranslateMessage
DispatchMessageA
IsWindowVisible
IsChild
GetClassNameA
DestroyIcon
CreateIconFromResourceEx
CreateIconFromResource
gdi32
GetStockObject
GetObjectType
GetObjectA
DeleteObject
SetBkColor
SetTextColor
CreateSolidBrush
CreateCompatibleDC
GetDIBits
DeleteDC
CreateDIBSection
SelectObject
BitBlt
CreateBitmap
SetPixel
SetDIBits
CreateDCA
GetDeviceCaps
CreateFontA
comctl32
InitCommonControlsEx
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListA
ShellExecuteExA
winmm
timeBeginPeriod
timeEndPeriod
ole32
CoTaskMemFree
RevokeDragDrop
Sections
.code Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: 96KB - Virtual size: 96KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 53KB - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ