Static task
static1
Behavioral task
behavioral1
Sample
d4cb0e53ae34598b2c17aa520e8f5c10_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d4cb0e53ae34598b2c17aa520e8f5c10_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
d4cb0e53ae34598b2c17aa520e8f5c10_JaffaCakes118
-
Size
393KB
-
MD5
d4cb0e53ae34598b2c17aa520e8f5c10
-
SHA1
71313fbfee4dfce59f988de333b55edcd122f2a8
-
SHA256
2bf1f787d06b59fd08418261b8502cba874b69ca6f77421dda56b28265b97fbe
-
SHA512
30188326984b8c2d19605bc03b734c553ba31fb49507f7282a2673a829614112cb4376cffc802990d5964f70b09bde7468a9257a0b6a4ba5a06de8a86fe3fa3e
-
SSDEEP
12288:kQKXBQMqVX1s6mTooi6cl854F6qLPkh4:AxqV24J6clEQBLMy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d4cb0e53ae34598b2c17aa520e8f5c10_JaffaCakes118
Files
-
d4cb0e53ae34598b2c17aa520e8f5c10_JaffaCakes118.exe windows:4 windows x86 arch:x86
526fb094a1b61fb93ae1131d019e8433
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCurrentProcessId
GlobalFlags
GetModuleHandleW
OpenSemaphoreA
RtlUnwind
GetConsoleScreenBufferInfo
FormatMessageA
GetCurrentProcess
GetProcAddress
VirtualAlloc
CreateSemaphoreA
IsValidCodePage
HeapReAlloc
SetConsoleActiveScreenBuffer
PulseEvent
GetConsoleTitleA
HeapFree
InterlockedExchange
GetModuleFileNameA
TerminateProcess
GetModuleHandleA
ExitProcess
CreateSemaphoreW
WriteProfileStringW
GetNumberFormatW
LoadLibraryA
GetTickCount
GetSystemTimeAsFileTime
CreateMailslotA
CopyFileA
FlushInstructionCache
QueryPerformanceCounter
GetExitCodeThread
GetPrivateProfileIntA
OpenProcess
VirtualQuery
GetCurrentThreadId
GetCurrentThread
HeapAlloc
user32
CharLowerBuffA
CreateMenu
EnumPropsExW
RealGetWindowClass
GetDialogBaseUnits
DdeGetData
EnumWindowStationsW
PostMessageW
GetClipboardSequenceNumber
GetDoubleClickTime
GetKeyboardLayout
TrackPopupMenu
MsgWaitForMultipleObjectsEx
GetMenuState
shell32
SHQueryRecycleBinA
SheChangeDirExW
SHBrowseForFolderA
SHEmptyRecycleBinW
ShellExecuteExA
ExtractIconEx
ShellExecuteW
SHFormatDrive
SHGetPathFromIDList
RealShellExecuteExA
DoEnvironmentSubstW
FindExecutableW
ShellHookProc
SHGetDataFromIDListA
DragQueryFileA
DuplicateIcon
ExtractAssociatedIconExW
SHFileOperationW
Sections
.text Size: 114KB - Virtual size: 114KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 263KB - Virtual size: 263KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ