Static task
static1
Behavioral task
behavioral1
Sample
db785521c84b15caac5723c1ef3a3dfa_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
db785521c84b15caac5723c1ef3a3dfa_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
db785521c84b15caac5723c1ef3a3dfa_JaffaCakes118
-
Size
324KB
-
MD5
db785521c84b15caac5723c1ef3a3dfa
-
SHA1
84221ab3e9b62b691c9e818082fa1873f4cb3182
-
SHA256
8ca8956fc35ef5ad8014f859471a63789ef4a132afa06c80901a2e6251d8a3c7
-
SHA512
6faea636db0fde66ad8a8c6ab1039599d167fe0013941ed0f9bcef1beee476fc2a2dc4cb0ddae33dbf6f09a66e6e8ac2da9c885fc429bf1335cb435b34b006c7
-
SSDEEP
6144:AFTzqiE66XLRY2VsouQlAhziNGbBYUWf4EDjH:MR76XVY2WSGbBBE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource db785521c84b15caac5723c1ef3a3dfa_JaffaCakes118
Files
-
db785521c84b15caac5723c1ef3a3dfa_JaffaCakes118.exe windows:1 windows x86 arch:x86
f1c1b299d612cf0588fedd32241a2ed4
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
gdi32
MoveToEx
kernel32
CloseHandle
CopyFileA
CreateFileA
CreateProcessA
DeleteFileA
ExitProcess
FindClose
FindFirstFileA
FindNextFileA
GetCommandLineA
GetCurrentProcess
GetExitCodeProcess
GetFileAttributesA
GetFileType
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetStartupInfoA
GetStringTypeA
GetVersionExA
GetVolumeInformationA
GlobalAlloc
GlobalFree
GlobalReAlloc
LoadLibraryA
MultiByteToWideChar
OpenProcess
ReadFile
SetEndOfFile
SetErrorMode
SetFileAttributesA
SetFilePointer
SetLastError
Sleep
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
WaitForSingleObject
WideCharToMultiByte
WriteFile
FindResourceA
FlushInstructionCache
GetFileInformationByHandle
GetSystemInfo
GetTempPathA
LockResource
MoveFileExA
OpenFile
SetFileTime
SizeofResource
VirtualAlloc
VirtualFree
VirtualProtect
RtlMoveMemory
ole32
CLSIDFromProgID
CoCreateInstance
CoInitialize
CoUninitialize
ProgIDFromCLSID
oleaut32
GetActiveObject
SafeArrayCreate
SysAllocStringByteLen
SysFreeString
SysStringByteLen
VariantClear
VariantCopy
user32
CharLowerBuffA
CharNextA
CharUpperBuffA
CreateDialogIndirectParamA
CreateDialogParamA
CreateWindowExA
DialogBoxIndirectParamA
CharUpperA
DialogBoxParamA
GetWindow
Sections
.text Size: 38KB - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.link Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 277KB - Virtual size: 277KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rloc Size: 1024B - Virtual size: 844B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ