Static task
static1
Behavioral task
behavioral1
Sample
c0fff6a5808d5e2b97a20274c7267a29_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
c0fff6a5808d5e2b97a20274c7267a29_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
c0fff6a5808d5e2b97a20274c7267a29_JaffaCakes118
-
Size
145KB
-
MD5
c0fff6a5808d5e2b97a20274c7267a29
-
SHA1
50e05c1d96e4504a86be66603dae9d2b069e9b3c
-
SHA256
6a20a4ba87788dcaadb66267ec3f181d409ef0b7554cf46183a3f410687832f1
-
SHA512
dc03cd9f371026a30fc1dee37d3cba184eb0ea79d8ee7c6a454b5042b3aa2303eb5df9f432c86eb8520ad046ef3fec068f81088152bf7de0d2ad083416989e3a
-
SSDEEP
3072:nvM5V6ayxUFR/BxILrOUEnV6dd477JsNLZW9mQib:vg67gaLrOUE6d+7VJ4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c0fff6a5808d5e2b97a20274c7267a29_JaffaCakes118
Files
-
c0fff6a5808d5e2b97a20274c7267a29_JaffaCakes118.exe windows:4 windows x86 arch:x86
07e456bfbc691a9db1d7acdec8e2c78e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
PathIsDirectoryW
PathAppendW
PathRenameExtensionW
PathRemoveFileSpecW
PathCombineW
PathAddBackslashW
PathIsRelativeW
PathRemoveBackslashW
PathFileExistsW
ole32
CoFreeUnusedLibraries
CoUninitialize
CoInitialize
StringFromGUID2
CoCreateInstance
gdiplus
GdipCreateBitmapFromFile
GdipGetImagePixelFormat
GdipGetImageWidth
GdipGetImageHeight
GdipDisposeImage
winmm
timeGetTime
kernel32
RemoveDirectoryW
OutputDebugStringW
FindClose
ClearCommBreak
CloseHandle
DeleteCriticalSection
InitializeCriticalSection
GetVersionExW
DeleteFileW
FindFirstFileW
GlobalLock
LocalFree
EnterCriticalSection
ClearCommBreak
DisableThreadLibraryCalls
GetTempFileNameW
GetModuleFileNameW
GetACP
GetVersionExA
LocalAlloc
lstrlenA
lstrlenW
EnumResourceNamesW
CreateDirectoryW
GetModuleFileNameA
ReadFile
GetLastError
InterlockedExchange
QueryPerformanceCounter
CopyFileW
ExitProcess
GetTickCount
FindNextFileW
GetCurrentProcessId
CreateFileW
GlobalAlloc
InterlockedIncrement
LeaveCriticalSection
FreeLibrary
SetFileAttributesW
MultiByteToWideChar
ExitProcess
GetLocaleInfoA
GlobalUnlock
GetThreadLocale
GetTempPathW
GetProcAddress
GetCurrentThreadId
LoadLibraryW
GetFullPathNameW
InterlockedDecrement
WideCharToMultiByte
Sleep
GetSystemTimeAsFileTime
GetFileAttributesExW
shell32
SHGetSpecialFolderPathW
DragQueryFileW
comctl32
ImageList_DragMove
ImageList_DragLeave
ImageList_DragEnter
gdi32
CreateCompatibleDC
CreatePen
ExtCreatePen
CreateCompatibleBitmap
BitBlt
StrokePath
SetBkMode
BeginPath
CreatePolygonRgn
CreateDCW
DeleteDC
CreateSolidBrush
GetBitmapBits
GetObjectType
GetDeviceCaps
CreateDIBSection
CreateBitmap
SetROP2
CreateFontIndirectW
SetStretchBltMode
MoveToEx
Polyline
DeleteObject
InvertRgn
SelectObject
StretchBlt
EndPath
PtInRegion
LineTo
GetObjectW
advapi32
RegCreateKeyW
RegSetValueW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegSetValueExW
RegDeleteKeyW
RegEnumKeyExW
user32
EmptyClipboard
ReleaseCapture
UpdateWindow
OffsetRect
CloseClipboard
InvalidateRect
GetFocus
PtInRect
SetRectEmpty
ClientToScreen
SetRect
TrackPopupMenuEx
GetClipboardData
ReleaseDC
GetKeyState
RedrawWindow
GetParent
SetWindowPos
LoadCursorW
IsWindow
SendMessageW
FillRect
EnableWindow
GetDC
IntersectRect
SetCapture
SetCursor
GetWindowRect
TranslateMessage
GetDesktopWindow
UnionRect
SetParent
CopyRect
DestroyMenu
EqualRect
OpenClipboard
SetClipboardData
ClipCursor
wsprintfW
GetClientRect
IsRectEmpty
CreatePopupMenu
ScreenToClient
msimg32
AlphaBlend
TransparentBlt
Sections
.text Size: 102KB - Virtual size: 101KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 37KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsr Size: 512B - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ