Static task
static1
Behavioral task
behavioral1
Sample
d14035931c11bc878801faa5e25122c0_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d14035931c11bc878801faa5e25122c0_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
d14035931c11bc878801faa5e25122c0_JaffaCakes118
-
Size
148KB
-
MD5
d14035931c11bc878801faa5e25122c0
-
SHA1
9ca0978515389fbaecc7e02fc9c55104b833a63d
-
SHA256
dae3ec38f63c0c2feffe59998950ad5ed9c56d6b2b95f1813910f6d0f525a12c
-
SHA512
3c634fdbdf86a9befaccf42dbedac0959c9b4da91ac0bc1695181fcc72e31b42c4c35525c528f6d1dbce9d4ac7378105c639e5292e0579a5a429e7fe4b889fb4
-
SSDEEP
1536:+yIBEGdkH9fpgT7NRN7LSpT1t9dlrli6H+lmL13BF/X0YO5qopnnxXUA/j:xIBEm8hgfNRdo9dlrrXRF/kYO5qoP77
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d14035931c11bc878801faa5e25122c0_JaffaCakes118
Files
-
d14035931c11bc878801faa5e25122c0_JaffaCakes118.exe windows:4 windows x86 arch:x86
1607684ee6a4f9e66a35ecabbe31f2f0
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetEndOfFile
DeleteFileA
ReadFile
GetFileSize
FreeResource
LoadResource
CreateFileA
SizeofResource
FindResourceA
GetModuleFileNameA
GetSystemTime
GetComputerNameA
SetErrorMode
GetVersionExA
GetWindowsDirectoryA
CreateThread
WriteFile
SetFilePointer
DeleteCriticalSection
lstrlenA
GetTickCount
CreateProcessA
GetDriveTypeA
GetLogicalDrives
FindClose
FindNextFileA
FindFirstFileA
GetFileAttributesA
CopyFileA
MoveFileA
CreateDirectoryA
GetTempPathA
GetShortPathNameA
ResetEvent
EnterCriticalSection
InitializeCriticalSection
CreateEventA
LoadLibraryA
LCMapStringW
GetACP
GetCPInfo
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetLastError
TlsGetValue
SetLastError
TlsAlloc
TlsSetValue
CloseHandle
HeapSize
HeapReAlloc
SetEvent
Sleep
LeaveCriticalSection
GetProcAddress
FreeLibrary
GetModuleHandleA
ExitProcess
OpenProcess
WaitForSingleObject
TerminateProcess
GetCurrentThreadId
HeapFree
HeapAlloc
GetVersion
GetCurrentProcess
LCMapStringA
GetOEMCP
RtlUnwind
GetCommandLineA
GetStartupInfoA
user32
CharLowerA
wsprintfA
EnumWindows
PostMessageA
DispatchMessageA
GetWindowThreadProcessId
GetParent
ExitWindowsEx
CreateDialogParamA
PeekMessageA
IsDialogMessageA
UpdateWindow
GetDC
GetClientRect
SetWindowTextA
ReleaseDC
SetFocus
DefWindowProcA
PostQuitMessage
EndDialog
GetDlgItemTextA
GetDlgItem
EnableWindow
ShowWindow
DialogBoxParamA
FindWindowA
RegisterClassExA
CreateWindowExA
SetTimer
GetMessageA
MessageBoxA
CharUpperA
gdi32
GetStockObject
DeleteObject
Rectangle
SelectObject
CreateSolidBrush
advapi32
RegOpenKeyExA
RegDeleteValueA
RegDeleteKeyA
RegEnumKeyExA
GetUserNameA
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
shell32
ShellExecuteA
wsock32
htons
WSACleanup
WSAStartup
send
ioctlsocket
gethostbyname
connect
WSAAsyncSelect
closesocket
socket
recv
version
GetFileVersionInfoA
VerQueryValueA
lz32
LZCopy
LZClose
LZOpenFileA
Sections
pec1 Size: 104KB - Virtual size: 104KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
pec2 Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ