Static task
static1
Behavioral task
behavioral1
Sample
cf6d84ba47c1567992a6dc583549964f_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
cf6d84ba47c1567992a6dc583549964f_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
cf6d84ba47c1567992a6dc583549964f_JaffaCakes118
-
Size
161KB
-
MD5
cf6d84ba47c1567992a6dc583549964f
-
SHA1
cedaf2727a293e6f076e5b99544b8a46f31eae83
-
SHA256
06c152def9ea1e556248468a63d950dcfc72042f44aed02cf6bd083c0928e622
-
SHA512
99b333bd4590170b43aa62848c40fc2204196b524c9134000e9c72d94ae5269df9c43d8a83a20d41fb66e913aeae99612d08ef9dcbbeba9bc3a5fcbcfb8a6f4f
-
SSDEEP
3072:RxUYKciBwMzodoXkbxKq+jXp/Wysw3o2rE1Mx60hbzqfRPXnOluqwu:sTBwM0pbvUCw3u1MxvzqfVelu5u
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cf6d84ba47c1567992a6dc583549964f_JaffaCakes118
Files
-
cf6d84ba47c1567992a6dc583549964f_JaffaCakes118.exe windows:4 windows x86 arch:x86
fb3b262d732dc5377285d5c2af414bf5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
DuplicateTokenEx
RegQueryValueExA
kernel32
InitializeCriticalSection
shlwapi
PathCombineW
PathRemoveFileSpecW
SHDeleteKeyA
StrCmpNIA
StrStrW
wnsprintfA
wnsprintfW
user32
ExitWindowsEx
FindWindowExA
GetCursorPos
GetWindowLongA
GetWindowTextA
LoadCursorA
SendMessageA
SetProcessWindowStation
SetThreadDesktop
Sections
.bqdef Size: 43KB - Virtual size: 60KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sbun Size: 1024B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.mngloh Size: 5KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ