Static task
static1
Behavioral task
behavioral1
Sample
da2d1a1a0574cc90310b3e9029b04206_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
da2d1a1a0574cc90310b3e9029b04206_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
da2d1a1a0574cc90310b3e9029b04206_JaffaCakes118
-
Size
258KB
-
MD5
da2d1a1a0574cc90310b3e9029b04206
-
SHA1
c3c96171c3261028e156bc9b11e1215a5ba72bd1
-
SHA256
583f524798c36ad79f350531b87541f825bb42c09408ae2b43f517ba7299d8ed
-
SHA512
9404e06df09aee35546c3ec85a9d0b22203564faa31a1f3b427f3b85de94bfe90981298eb665bee05c37f43caaef6f9758ce7df6166ca86b5783cd4b39e6b9fe
-
SSDEEP
6144:8perJRwEh2KyXzKXOtjBmfsNH5SoKZ2Ok37jOrgpxuLeMGL6KX3UW:70Eh8XeetjsfoCRk3fHxAs+K3U
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource da2d1a1a0574cc90310b3e9029b04206_JaffaCakes118
Files
-
da2d1a1a0574cc90310b3e9029b04206_JaffaCakes118.exe windows:4 windows x86 arch:x86
4a2fa7abc9171dba8ae43d97100eb6aa
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCurrentThreadId
WaitForSingleObject
Sleep
GetVersion
GetVersionExW
GetCurrentProcessId
WaitForMultipleObjects
DuplicateHandle
SetEvent
OpenMutexW
LocalFree
LocalAlloc
GetModuleHandleA
lstrcmpA
GetCurrentThread
GetTickCount
GetModuleFileNameW
GetTempPathW
GetTempFileNameW
CreateEventW
InitializeCriticalSection
CreateSemaphoreW
lstrcpynA
lstrlenA
GetFullPathNameA
GetFileAttributesA
lstrcpynW
lstrlenW
GetFileAttributesW
MultiByteToWideChar
GetModuleHandleW
ExpandEnvironmentStringsW
FreeLibrary
LoadLibraryW
SetErrorMode
GetCurrentProcess
CreateMutexW
GetLastError
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LoadLibraryA
QueryPerformanceCounter
GetVersionExA
GetProcessHeap
RaiseException
SetUnhandledExceptionFilter
TlsAlloc
ExitProcess
HeapCreate
GetModuleFileNameA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetStartupInfoA
GetEnvironmentStringsW
GetLocalTime
GetProcAddress
user32
MessageBoxW
PeekMessageW
DefWindowProcA
GetMenu
SetWindowPos
CreatePopupMenu
GetClassInfoExA
SendDlgItemMessageW
GetMenuItemRect
RegisterWindowMessageW
GetCapture
MessageBoxA
GetCaretPos
MessageBoxIndirectA
SetCursor
mouse_event
SendMessageW
GetSubMenu
CharPrevW
GetAsyncKeyState
GetMessageA
GetMenuItemID
OpenClipboard
LoadBitmapW
CharLowerW
GetClassInfoA
GetDlgItemTextW
DialogBoxIndirectParamW
advapi32
RegQueryValueExA
RegOpenKeyA
FreeSid
AllocateAndInitializeSid
GetTokenInformation
OpenProcessToken
RegEnumKeyW
RegQueryValueExW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegDeleteKeyW
RegDeleteKeyA
EqualSid
shell32
SHGetDesktopFolder
ShellExecuteExW
ord680
ole32
CoUninitialize
CoInitializeEx
security
SealMessage
CompleteAuthToken
gdi32
CreatePalette
CreateEllipticRgn
TranslateCharsetInfo
GetRasterizerCaps
CreateColorSpaceA
CreateFontW
CreateRoundRectRgn
GetTextExtentPointW
SelectBrushLocal
Sections
.text Size: 11KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.FTPE Size: 2KB - Virtual size: 180KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.s Size: 1024B - Virtual size: 268KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.i Size: 92KB - Virtual size: 127KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.j Size: 5KB - Virtual size: 370KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.kLjQcb Size: 1KB - Virtual size: 469KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 6KB - Virtual size: 383KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.TEURV Size: 124KB - Virtual size: 135KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ