Static task
static1
Behavioral task
behavioral1
Sample
d99c92d4f2511bb3177b65ae8428472b_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d99c92d4f2511bb3177b65ae8428472b_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
d99c92d4f2511bb3177b65ae8428472b_JaffaCakes118
-
Size
169KB
-
MD5
d99c92d4f2511bb3177b65ae8428472b
-
SHA1
6f8fa852d13c7f349d6019b797dec87c82f45c6e
-
SHA256
11619e259cb5b25a28acc0bedde69ccb52d1f122cbe80a1c0e8f85a228fec146
-
SHA512
653c36bd1dd2802794dc3d93c61a0f3fce5c482eef14f629eb32a229b25f3422c9d99030008e30887e786f80818f0ad79339c695229cf10ddb741db02c39cb9a
-
SSDEEP
3072:vr9AZI1xCRBFVsijMe8dHmfVoc6eZZ71VC9FfRZz/3dD07Y5yFLsahZMvsJftfg:GRBFy6MPwfacPZ7rCnbzJKKGzvJf6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d99c92d4f2511bb3177b65ae8428472b_JaffaCakes118
Files
-
d99c92d4f2511bb3177b65ae8428472b_JaffaCakes118.exe windows:4 windows x86 arch:x86
257bd9eceb3dfcf9fd5492ff35e553e2
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
ord8
shell32
SHGetFolderLocation
SHInvokePrinterCommandW
DragAcceptFiles
SHGetInstanceExplorer
gdi32
SetMetaRgn
GetDeviceGammaRamp
GetRegionData
Rectangle
comctl32
ord8
ord5
CreatePropertySheetPageA
kernel32
GetDateFormatW
ReadConsoleOutputW
Sleep
GetProcAddress
LoadLibraryA
GetModuleHandleA
FindNextVolumeW
FreeConsole
GetConsoleFontSize
ConvertFiberToThread
GetStringTypeW
GetProcessHeaps
GetFileSize
CopyFileW
LocalSize
LeaveCriticalSection
GetLongPathNameW
GetSystemTimeAsFileTime
GetDllDirectoryW
IsBadWritePtr
VirtualLock
lstrcpyA
GetStartupInfoA
user32
ScrollWindow
LoadMenuIndirectW
DestroyWindow
GetKeyNameTextW
wvsprintfW
GetMenuStringW
DrawEdge
UnhookWindowsHookEx
CharPrevExA
GetNextDlgGroupItem
GetDCEx
DispatchMessageW
msvcrt
iswcntrl
ctime
getwc
swprintf
abs
wcsstr
isprint
isspace
wcsrchr
setvbuf
wcspbrk
_exit
_XcptFilter
_cexit
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
malloc
memcpy
memmove
memset
_c_exit
Sections
.text Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 130KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE