Static task
static1
Behavioral task
behavioral1
Sample
d32af74311d009d6756d6e5814041eac_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d32af74311d009d6756d6e5814041eac_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
d32af74311d009d6756d6e5814041eac_JaffaCakes118
-
Size
208KB
-
MD5
d32af74311d009d6756d6e5814041eac
-
SHA1
2c5a2abe9d91b9f540487991ef7830e5099d2118
-
SHA256
0085808c773edff1f3df6cf7ffd6a5a6fc4957db71c70dfd646af475ba72e551
-
SHA512
e3b0caeab5c5789daddeb656a2e0288459f5d5d09080043c72935e73b40886b82c55cb9fce15043a4611bece4cd7212966090f26ae39f9f6a33fb540f9ad8739
-
SSDEEP
3072:hLLFp/ljbCjrL0oNa/rInoUtq1cGZuqMbvTxKI0oWSLvBSq2R7XIbHmSDZX:tnlqj30oAzUtq1cGsH0ILYqw7X7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d32af74311d009d6756d6e5814041eac_JaffaCakes118
Files
-
d32af74311d009d6756d6e5814041eac_JaffaCakes118.exe windows:4 windows x86 arch:x86
6ae75b121d33383f73885b13d1fec55d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
SHDeleteValueA
PathGetCharTypeA
PathIsContentTypeA
SHQueryInfoKeyA
SHEnumValueA
SHDeleteKeyA
msvcrt
memset
srand
pow
strcmp
comdlg32
ChooseColorA
GetSaveFileNameA
FindTextA
GetOpenFileNameA
GetFileTitleA
user32
RegisterWindowMessageA
RedrawWindow
MessageBoxA
PeekMessageW
PostMessageA
LoadIconA
OffsetRect
PostQuitMessage
PeekMessageA
ReleaseCapture
RemovePropA
LoadStringA
RemoveMenu
SetActiveWindow
SendMessageA
LoadBitmapA
RegisterClassA
PtInRect
MapVirtualKeyA
ReleaseDC
LoadCursorA
MessageBeep
RegisterClipboardFormatA
LoadKeyboardLayoutA
MapWindowPoints
OemToCharA
OpenClipboard
ScrollWindow
SendMessageW
ScreenToClient
gdi32
CreateFontIndirectA
CreatePenIndirect
CreateDIBitmap
SetPixel
SetTextColor
CreatePalette
CreateCompatibleBitmap
GetBitmapBits
oleaut32
RegisterTypeLib
GetErrorInfo
version
GetFileVersionInfoSizeA
kernel32
VirtualQuery
lstrcmpiA
lstrcpynA
ExitThread
GetVersionExA
lstrcmpA
VirtualAllocEx
IsBadReadPtr
WriteFile
WideCharToMultiByte
MulDiv
LocalFree
lstrcpyA
VirtualFree
lstrlenA
MoveFileA
SizeofResource
LocalReAlloc
lstrlenW
lstrcatA
GetModuleHandleW
LoadLibraryA
VirtualAlloc
WaitForSingleObject
GetModuleHandleA
ExitProcess
LocalAlloc
MoveFileExA
GetProcAddress
HeapDestroy
comctl32
ImageList_Write
ImageList_DragShowNolock
ImageList_Add
ImageList_Draw
ole32
CLSIDFromString
WriteClassStm
PropVariantClear
shell32
SHGetSpecialFolderLocation
SHFileOperationA
SHGetDiskFreeSpaceA
Sections
.text Size: 73KB - Virtual size: 73KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 649B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc9 Size: 512B - Virtual size: 414B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc5 Size: 123KB - Virtual size: 123KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc2 Size: 1024B - Virtual size: 675B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc8 Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc6 Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 976B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ