Static task
static1
Behavioral task
behavioral1
Sample
cf6a44675a7a9a30bf05cfa88f7f6d71_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
cf6a44675a7a9a30bf05cfa88f7f6d71_JaffaCakes118
-
Size
428KB
-
MD5
cf6a44675a7a9a30bf05cfa88f7f6d71
-
SHA1
a7d034b47251ed68e336827606dab7b5987400a9
-
SHA256
edc86069885fb8c2f0b676f00acbb16fcd6f4fc510f5c74f5fd7569890c8023b
-
SHA512
bf59e1de12ece01b5a680320df021787de0939dedf532aa44cbcfb74f93874bddda2be79c6a591eb11766ae76f914a4253146493ceef7b84148a58fd220e6f4f
-
SSDEEP
6144:322BdnF779yjZFahRuixRFMTNT+aPPpS:320dRQjbahRuEKTjpS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cf6a44675a7a9a30bf05cfa88f7f6d71_JaffaCakes118
Files
-
cf6a44675a7a9a30bf05cfa88f7f6d71_JaffaCakes118.exe windows:5 windows x86 arch:x86
3a5fbf666401ba607a4e2e6acb05e42f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
wininet
GetUrlCacheEntryInfoA
ntdll
tolower
secur32
FreeCredentialsHandle
InitializeSecurityContextA
ole32
MkParseDisplayName
gdi32
GetCharWidth32A
FrameRgn
GdiFlush
GetCurrentPositionEx
GetMapMode
DeleteObject
DeleteDC
ExtTextOutA
GetPixel
LineDDA
FillPath
GetClipRgn
GetWindowOrgEx
shell32
ExtractAssociatedIconW
urlmon
IsValidURL
MkParseDisplayNameEx
msvcrt
fputs
fputc
winmm
timeGetTime
DefDriverProc
advapi32
RegDisableReflectionKey
GetCurrentHwProfileA
GetEventLogInformation
oleaut32
GetRecordInfoFromTypeInfo
user32
IsIconic
GetMessageExtraInfo
GetTopWindow
LoadAcceleratorsW
GetMessageW
GetCursor
MessageBoxIndirectW
GetPropW
LoadKeyboardLayoutW
EndDialog
GetCaretPos
GetTitleBarInfo
GetMessagePos
GetLastInputInfo
GetDlgItemTextA
EqualRect
GetTabbedTextExtentW
GetDlgItem
FlashWindowEx
DrawFrameControl
IsWinEventHookInstalled
DdeAbandonTransaction
GetKeyboardType
VkKeyScanExA
LoadMenuA
GetKeyboardLayout
GetWindowLongA
GetClipCursor
IsZoomed
DialogBoxParamA
kernel32
GetCurrentProcess
GetVolumeInformationW
WriteProcessMemory
GetStartupInfoW
SetEvent
GetModuleHandleW
FindFirstVolumeMountPointW
lstrcpynA
GetSystemWindowsDirectoryW
GetThreadPriority
VirtualAlloc
EnumResourceTypesA
GlobalHandle
GetTickCount
LocalHandle
GetEnvironmentStringsW
DeleteTimerQueueEx
lstrcatW
GetProfileIntW
GetStringTypeW
GenerateConsoleCtrlEvent
GetProfileStringA
GetTimeZoneInformation
GetDefaultCommConfigA
GlobalLock
FindResourceExA
FindFirstFileW
GetLogicalDriveStringsA
FillConsoleOutputAttribute
GetDriveTypeW
FlushViewOfFile
VirtualFreeEx
GlobalMemoryStatus
WritePrivateProfileStructA
lstrcpyW
GetProcessId
IsValidLanguageGroup
GetPrivateProfileStringW
FindResourceExW
LocalFree
GetConsoleTitleA
comdlg32
GetOpenFileNameW
winspool.drv
FindClosePrinterChangeNotification
Sections
.text Size: 72KB - Virtual size: 69KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 52KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: 280KB - Virtual size: 278KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ