Static task
static1
Behavioral task
behavioral1
Sample
c9688b9bcd738f05dc38bf0f3b68a542_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
c9688b9bcd738f05dc38bf0f3b68a542_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
c9688b9bcd738f05dc38bf0f3b68a542_JaffaCakes118
-
Size
315KB
-
MD5
c9688b9bcd738f05dc38bf0f3b68a542
-
SHA1
1ae9c5b53b0c705854204f6875c558a386cd4b01
-
SHA256
c131e5cbd9d777d97d8ed7af6af99d0ee1ec7ca4a9a561434885fb2f7046e3f9
-
SHA512
053dbd84acb52cc8b209652030d7fab2958fe629940b5d7e0105458ed80f707c4ea006d1c7173ba54f77c43f84c1e5caaa743a953b47b0427e29d31751224629
-
SSDEEP
6144:eBi8NWF8AUL3BnZx2IZNSHkLKMyz0ucpfACpWoSP1VWaVozUpbNRhkdcFnpdkaBX:eBiEWWDyH2FfEVlbR6MN4m8Uyh
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c9688b9bcd738f05dc38bf0f3b68a542_JaffaCakes118
Files
-
c9688b9bcd738f05dc38bf0f3b68a542_JaffaCakes118.exe windows:4 windows x86 arch:x86
fda52942041cb9cb94415374444ae703
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
shell32
ExtractIconW
ExtractIconExA
SheGetDirA
DragQueryFileAorW
SHInvokePrinterCommandA
SHAddToRecentDocs
RealShellExecuteExW
DragFinish
SHBrowseForFolder
SHGetNewLinkInfo
SHChangeNotify
SHGetMalloc
DoEnvironmentSubstW
FreeIconList
InternalExtractIconListW
SHGetSettings
user32
RegisterHotKey
InvalidateRgn
CreateMDIWindowW
SetCursor
GetWindowLongW
BlockInput
ClientToScreen
IsDlgButtonChecked
GetMessagePos
MoveWindow
CreateDesktopA
SetWindowLongW
SetPropW
DrawTextA
DestroyCursor
GetQueueStatus
IsDialogMessage
ScrollDC
EnableMenuItem
GetAncestor
MessageBoxW
EnumWindowStationsA
wininet
InternetGetCookieA
ReadUrlCacheEntryStream
DeleteUrlCacheContainerA
InternetAlgIdToStringW
FindFirstUrlCacheEntryExW
comdlg32
ChooseColorA
ReplaceTextW
GetOpenFileNameW
ReplaceTextA
PrintDlgA
GetSaveFileNameW
ChooseFontW
PageSetupDlgW
ChooseFontA
FindTextW
FindTextA
GetOpenFileNameA
PrintDlgW
PageSetupDlgA
GetFileTitleW
GetSaveFileNameA
GetFileTitleA
LoadAlterBitmap
kernel32
VirtualAlloc
GetEnvironmentStringsW
GetLocaleInfoA
InterlockedExchange
FreeEnvironmentStringsA
OutputDebugStringA
DeleteCriticalSection
LocalCompact
QueryPerformanceCounter
TlsGetValue
SetConsoleActiveScreenBuffer
GetVersionExA
GetFileType
GetStartupInfoA
CloseHandle
SetLastError
UnhandledExceptionFilter
SetStdHandle
FreeEnvironmentStringsW
EnterCriticalSection
WriteFileEx
HeapCreate
GetCurrentThreadId
GlobalLock
GetDateFormatA
ExitProcess
GetSystemTimeAsFileTime
GetStringTypeW
FlushFileBuffers
GetTimeZoneInformation
IsBadWritePtr
WideCharToMultiByte
SetVolumeLabelA
GetLastError
HeapFree
GetTimeFormatA
LCMapStringW
LoadLibraryA
GetCurrentThread
FileTimeToLocalFileTime
HeapAlloc
GetOEMCP
GetEnvironmentStrings
TlsFree
VirtualQuery
GetUserDefaultLCID
GetCurrentProcessId
LCMapStringA
DebugBreak
GetModuleHandleA
IsValidLocale
InterlockedIncrement
GetWindowsDirectoryA
TlsAlloc
CompareStringA
GetLocaleInfoW
FindNextFileA
HeapReAlloc
GetTickCount
GetSystemInfo
GetCurrentProcess
LeaveCriticalSection
EnumSystemLocalesA
CreateDirectoryExA
SetFilePointer
VirtualProtect
GetModuleFileNameA
GetStringTypeA
GetStdHandle
TlsSetValue
GetShortPathNameA
OpenSemaphoreA
GetProcAddress
IsBadReadPtr
TerminateProcess
GetCPInfo
RtlUnwind
InitializeCriticalSection
HeapDestroy
GetACP
SetEnvironmentVariableA
VirtualFree
SetConsoleCtrlHandler
lstrlen
MultiByteToWideChar
WriteFile
HeapValidate
IsValidCodePage
CompareStringW
SetHandleCount
InterlockedDecrement
GetCommandLineA
Sections
.text Size: 162KB - Virtual size: 161KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 144KB - Virtual size: 158KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ