Static task
static1
Behavioral task
behavioral1
Sample
d29c6c83f05e7f731c0cfc08995c2261_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d29c6c83f05e7f731c0cfc08995c2261_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
d29c6c83f05e7f731c0cfc08995c2261_JaffaCakes118
-
Size
167KB
-
MD5
d29c6c83f05e7f731c0cfc08995c2261
-
SHA1
6eacdebee170a4afc5ed302a76278c739c23cdc8
-
SHA256
ca3808b5208193904a569753525ed8916ecb6644050ffa6f04a8516fb1df6c08
-
SHA512
dd184432ae8b59fdb43855a2e3b1c0eeb9b29b3aae6fe17bbe4ced729e4cccbab069fcdad1f99be397ecaad6d515ea8d30f0a18248d6cac874fd9c6321ba6e6b
-
SSDEEP
3072:XLVwIKtBbPSopLsGkSQ9nX6FNXI1lWzQjvE0RC+C:XLVObNLsGk9UXI7WzQA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d29c6c83f05e7f731c0cfc08995c2261_JaffaCakes118
Files
-
d29c6c83f05e7f731c0cfc08995c2261_JaffaCakes118.exe windows:4 windows x86 arch:x86
589db03d08743bc0bd706c89fe32326e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetDriveTypeA
GlobalFindAtomW
CopyFileA
GetWindowsDirectoryA
DeleteFileW
GetCommandLineA
MulDiv
GlobalFindAtomA
IsDebuggerPresent
GetCommandLineW
DeleteFileA
GetCurrentThread
VirtualAlloc
lstrcmpA
lstrlenA
GetModuleHandleA
VirtualFree
GetOEMCP
GetProcessHeap
GetStartupInfoA
RemoveDirectoryA
lstrcmpiW
GetThreadLocale
GetUserDefaultLangID
GetCurrentThreadId
SetCurrentDirectoryA
GetACP
GetCurrentProcess
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetModuleHandleW
GetConsoleOutputCP
GetVersion
lstrlenW
gdi32
GetTextMetricsA
RestoreDC
DeleteObject
CreateSolidBrush
GetObjectA
GetClipBox
GetDeviceCaps
SetMapMode
CreateCompatibleDC
SetTextColor
SaveDC
SetStretchBltMode
DeleteDC
LineTo
GetPixel
SetTextAlign
SelectObject
RectVisible
CreatePalette
CreatePen
SelectPalette
CreateFontIndirectA
PatBlt
GetStockObject
user32
GetSystemMetrics
GetParent
GetDC
GetDesktopWindow
CharNextA
TranslateMessage
glu32
gluNurbsCallback
Sections
.text Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Equtqwjy Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 26KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Ecrka. O Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 99KB - Virtual size: 99KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ