Static task
static1
Behavioral task
behavioral1
Sample
db23daf7740a54199249c524eb5ee6de_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
db23daf7740a54199249c524eb5ee6de_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
db23daf7740a54199249c524eb5ee6de_JaffaCakes118
-
Size
81KB
-
MD5
db23daf7740a54199249c524eb5ee6de
-
SHA1
89ba50afc1efac9c4f0f317893514b474eedb738
-
SHA256
c41701bda6a97021020518f15420a218530f47e11c35904acfd1d6792d47bc94
-
SHA512
57cc8acc1694354c062f3cebc8a9395b7f8de13aaa20ff81d896ccb6fd0e08af86d95532e232f1be692a7d7ce17aef16f2ce00276717578644412dd69fd2f494
-
SSDEEP
1536:/WEhGsWPJdLeBbA2a9Dpbm9kmySxhVYWG/Tex94Icx3/58uO5E8p3:OEhroL2boVboZdxwWrx9038P5X
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource db23daf7740a54199249c524eb5ee6de_JaffaCakes118
Files
-
db23daf7740a54199249c524eb5ee6de_JaffaCakes118.exe windows:5 windows x86 arch:x86
9969dfbb52ffd80990e172c98ad62f71
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
user32
SetWindowTextA
GetScrollPos
EnableMenuItem
FrameRect
GetSubMenu
EnumWindows
SetWindowPos
UnhookWindowsHookEx
GetSysColorBrush
PostQuitMessage
EqualRect
GetSysColor
GetMessageA
kernel32
GetACP
RtlUnwind
FileTimeToSystemTime
InterlockedExchange
GetFileAttributesA
VirtualAllocEx
GetCurrentProcessId
GetSystemTime
ExitProcess
GetThreadLocale
GetStartupInfoA
GetTempPathA
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetOEMCP
GetTimeZoneInformation
gdi32
FillRgn
SetViewportExtEx
ExcludeClipRect
DPtoLP
SelectClipPath
GetMapMode
CopyEnhMetaFileA
CreateCompatibleBitmap
CreateICW
ole32
CoInitialize
DoDragDrop
StringFromGUID2
CoTaskMemRealloc
CoInitializeSecurity
CoRevokeClassObject
CoCreateInstance
StgOpenStorage
OleRun
advapi32
AdjustTokenPrivileges
RegCreateKeyExW
GetUserNameA
QueryServiceStatus
RegQueryValueExW
GetSecurityDescriptorDacl
RegCreateKeyA
CryptHashData
FreeSid
CheckTokenMembership
msvcrt
_CIpow
fflush
signal
__getmainargs
puts
fprintf
__setusermatherr
strcspn
_mbscmp
_fdopen
_strdup
strlen
raise
__initenv
_lock
iswspace
_flsbuf
strncpy
comctl32
InitCommonControls
CreatePropertySheetPageA
ImageList_GetBkColor
ImageList_GetIcon
ImageList_SetIconSize
ImageList_LoadImageA
ImageList_GetIconSize
ImageList_Write
ImageList_LoadImageW
ImageList_Destroy
ImageList_DragEnter
ImageList_ReplaceIcon
ImageList_DrawEx
shell32
SHGetPathFromIDList
DoEnvironmentSubstW
ShellExecuteW
SHBrowseForFolderA
ExtractIconExW
ExtractIconW
CommandLineToArgvW
ShellExecuteEx
DragQueryFileW
DragAcceptFiles
DragQueryFileA
oleaut32
VariantCopy
SafeArrayPtrOfIndex
SafeArrayGetUBound
SysReAllocStringLen
SafeArrayUnaccessData
SafeArrayRedim
SafeArrayCreate
SafeArrayPutElement
Sections
.text Size: 34KB - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
cmrjkio Size: - Virtual size: 60KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE