Static task
static1
Behavioral task
behavioral1
Sample
d1b4e398f000d11e3a123f6e9d7ef129_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d1b4e398f000d11e3a123f6e9d7ef129_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
d1b4e398f000d11e3a123f6e9d7ef129_JaffaCakes118
-
Size
316KB
-
MD5
d1b4e398f000d11e3a123f6e9d7ef129
-
SHA1
74c149cccd08748f1a4932364c0c56e735e1ea00
-
SHA256
d432d5867ac8bc7c24abd0de668d146835ff39e5db101c44ca97ee5d4beb27e2
-
SHA512
bbda14d71608728b0f8f14291054582df7aaf79b6b6abc07928efb75f1cb1eefd1406343c818a0124856de3732d9c2aec008ed6f167d851930264c7d1e51dad8
-
SSDEEP
6144:QrMdxELT74WguP7eJ85VlGerWGFSg8p6M3CxQuYZTbPQnodj519ZEA:QrKxEv741uPCc+Gog8VZvPLD5EA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d1b4e398f000d11e3a123f6e9d7ef129_JaffaCakes118
Files
-
d1b4e398f000d11e3a123f6e9d7ef129_JaffaCakes118.exe windows:4 windows x86 arch:x86
fe4ab11e3273c82943f97651c423d004
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetTickCount
GetAtomNameA
GetEnvironmentVariableA
GetVersion
GetModuleHandleW
Sleep
SetCommMask
lstrcmpA
ExitProcess
GetLongPathNameW
ExpandEnvironmentStringsW
SetSystemTime
GetModuleHandleA
GetCurrentThread
GetProcessAffinityMask
GetCurrentProcess
VirtualAlloc
WideCharToMultiByte
GetTempPathW
GetProcessHeap
GetLastError
SetThreadAffinityMask
GetCurrentThreadId
GetACP
Process32FirstW
Module32First
GetCommandLineA
GetModuleFileNameA
GetCurrentProcessId
OpenFileMappingA
GetCommandLineW
SetConsoleCP
iashlpr
ShutdownIas
DoRequest
AllocateAttributes
MemFreeIas
FreeAttributes
msvcrt
_setjmp
_lseeki64
iswcntrl
__p__iob
fgetpos
??0exception@@QAE@XZ
_execl
__p__osver
_wpopen
_access
rand
towlower
_chdir
exit
user32
ShowOwnedPopups
CharToOemA
WaitMessage
GetDC
GetMessageTime
GrayStringW
GetWindowTextA
DialogBoxIndirectParamAorW
GetSystemMetrics
PrivateExtractIconsW
msi
ord173
ord145
ord32
ord121
ord51
ord92
ord66
ord19
ord17
ord175
ord228
ord103
ord81
Sections
.text Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.textbs Size: 155KB - Virtual size: 225KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DATA Size: 134KB - Virtual size: 209KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ