Static task
static1
Behavioral task
behavioral1
Sample
d203c1125c68b952893174b0b8779f45_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
d203c1125c68b952893174b0b8779f45_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
d203c1125c68b952893174b0b8779f45_JaffaCakes118
-
Size
248KB
-
MD5
d203c1125c68b952893174b0b8779f45
-
SHA1
0636c998d766dc78c99ea8c4699d9987fc80997e
-
SHA256
5f27726f4c5ccc22bae423bedbfe38391283818fae83d369e2e6e100e4d526ec
-
SHA512
515f0e8bd5515c3b9c7ea527edf9cf88b543ee260aa06c4ebe0eeaf8f573eaaf294067b3f50f472f9cd18e9764bd94b6e91d0a8039e3e13ce103824d55522bca
-
SSDEEP
6144:BleVdqcrrXH2CCBxvVDITp8n4LwDKpguuegg:fCrXovCd8n4kG+uueD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d203c1125c68b952893174b0b8779f45_JaffaCakes118
Files
-
d203c1125c68b952893174b0b8779f45_JaffaCakes118.exe windows:4 windows x86 arch:x86
6c10827b1a0faf08d5652ecc98dcfafb
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetModuleHandleA
GetProcAddress
user32
GetDC
gdi32
LineTo
advapi32
RegCloseKey
shell32
ShellExecuteW
ole32
CoInitialize
shlwapi
PathFileExistsW
msimg32
AlphaBlend
wtsapi32
WTSFreeMemory
version
VerQueryValueW
ws2_32
htons
netapi32
Netbios
Sections
.MPRESS1 Size: 222KB - Virtual size: 668KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE