Static task
static1
Behavioral task
behavioral1
Sample
db64f5c5c48aaf751c25e86e00300ae9_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
db64f5c5c48aaf751c25e86e00300ae9_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
db64f5c5c48aaf751c25e86e00300ae9_JaffaCakes118
-
Size
44KB
-
MD5
db64f5c5c48aaf751c25e86e00300ae9
-
SHA1
ada9b290b90562423135e8f334139102e55d3c6d
-
SHA256
1c1a3967479020e4f4f4a9235919d291ae19cc15a3b78b5d90fdfea5dba884f5
-
SHA512
1f05a563280b25541c4a71839f5af0eecb5399b1f11b7b602e624e151ed1f3ad42880c3a42647bff00c4c45a7624175fbe42a109d9cf902ac264491c51fa784f
-
SSDEEP
384:BDr7Q1d2HeGie0mlQVoBw72LzycmMTcHyy7aRBarPoiLB7m6lBfT//Acq3/AQc:RmGeFepHmMTEyWQQrPoiN7mcxcvHc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource db64f5c5c48aaf751c25e86e00300ae9_JaffaCakes118
Files
-
db64f5c5c48aaf751c25e86e00300ae9_JaffaCakes118.exe windows:4 windows x86 arch:x86
857c6287e98dd2eafa946eddd6d44eff
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
WriteFile
CreateFileA
LockResource
LoadResource
SizeofResource
FindResourceA
lstrcatA
GetProcAddress
LoadLibraryA
EndUpdateResourceA
UpdateResourceA
SetFilePointer
BeginUpdateResourceA
GetStringTypeA
LCMapStringW
GetFileSize
MultiByteToWideChar
GetOEMCP
GetACP
GetCPInfo
RtlUnwind
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetModuleFileNameA
UnhandledExceptionFilter
GetCurrentProcess
ReadFile
LCMapStringA
HeapAlloc
HeapFree
HeapReAlloc
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
TerminateProcess
GetStringTypeW
user32
EndDialog
SendMessageA
GetDlgItem
MessageBoxA
IsDlgButtonChecked
wsprintfA
DialogBoxParamA
LoadIconA
GetCursorPos
GetWindowRect
PtInRect
LoadCursorA
SetCursor
comdlg32
GetOpenFileNameA
GetSaveFileNameA
shell32
ExtractIconA
comctl32
ord17
Sections
.text Size: 16KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ