Static task
static1
Behavioral task
behavioral1
Sample
db892bd7e1975208a1eecfaabf200586_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
db892bd7e1975208a1eecfaabf200586_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
db892bd7e1975208a1eecfaabf200586_JaffaCakes118
-
Size
172KB
-
MD5
db892bd7e1975208a1eecfaabf200586
-
SHA1
5dfd7eec9819ea9d6c0a485c843396b7f4839db2
-
SHA256
c2e568e81d0c31fce7babdfe9e082e1894f149623bb09efd1eee42b8fb41fba6
-
SHA512
372c7978f63493e3198e8856bdca99c19d3951279cf10d3a8fa8c976619ef738e65058c7c015fc85271d5da6ad85a637cc3332c3dd2bfffb8ce4348c8553c5f6
-
SSDEEP
3072:HXjpi0Gpi72gjMVCLbZvUHqT1GccpufVJU:3VggjMVCLb1UU+QJU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource db892bd7e1975208a1eecfaabf200586_JaffaCakes118
Files
-
db892bd7e1975208a1eecfaabf200586_JaffaCakes118.exe windows:4 windows x86 arch:x86
e5daebf8eec2f2244c4549b0759287ea
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
wsock32
gethostbyname
wininet
InternetCloseHandle
HttpQueryInfoA
HttpSendRequestA
HttpOpenRequestA
InternetConnectA
InternetOpenA
InternetReadFile
InternetOpenUrlA
InternetGetConnectedState
kernel32
GetModuleHandleA
InterlockedIncrement
GetTempPathA
GetLastError
CreateDirectoryA
lstrcpyA
GetModuleFileNameA
GetFileSize
CreateFileA
DeleteFileA
FlushFileBuffers
WriteFile
GetTickCount
CreateThread
GetCommandLineA
lstrcmpA
GetShortPathNameA
CopyFileA
GetVersion
GetFullPathNameA
DebugBreak
OutputDebugStringA
GetStringTypeExA
GetThreadLocale
GetProcAddress
GetDiskFreeSpaceA
CreateMutexA
MulDiv
LeaveCriticalSection
EnterCriticalSection
SetFilePointer
Sleep
lstrcatA
GetVersionExA
CloseHandle
LoadLibraryA
HeapAlloc
GetSystemInfo
HeapCreate
InitializeCriticalSection
HeapDestroy
DeleteCriticalSection
FlushInstructionCache
GetCurrentProcess
FreeResource
GlobalFree
GlobalHandle
LockResource
LoadResource
FindResourceA
GlobalAlloc
lstrlenW
MultiByteToWideChar
GlobalUnlock
GlobalLock
CompareStringA
lstrcmpiA
WideCharToMultiByte
FreeLibrary
GetStartupInfoA
ExitProcess
HeapReAlloc
HeapFree
ReadFile
GetACP
GetOEMCP
InterlockedDecrement
lstrlenA
GetModuleFileNameW
SetEndOfFile
GetModuleHandleW
GetCurrentThreadId
SetLastError
LoadLibraryW
GetCPInfo
GetStringTypeW
GetStringTypeA
IsBadCodePtr
IsBadWritePtr
IsBadReadPtr
SetUnhandledExceptionFilter
TlsGetValue
TlsSetValue
RtlUnwind
GetStdHandle
LCMapStringA
LCMapStringW
GetFileType
TerminateProcess
SetStdHandle
user32
DispatchMessageA
ShowWindow
SetWindowTextA
IsDialogMessageA
SendMessageA
CharLowerA
GetMessageA
PostQuitMessage
LoadIconA
InvalidateRgn
RedrawWindow
GetFocus
CharNextA
GetDlgItem
DestroyWindow
SetWindowPos
SetCapture
ReleaseCapture
wsprintfA
CreateWindowExA
CreateAcceleratorTableA
GetDesktopWindow
GetClassNameA
IsWindow
BeginPaint
FillRect
EndPaint
GetDC
ReleaseDC
MapWindowPoints
GetWindowRect
GetClientRect
PostMessageA
MoveWindow
IsChild
SetFocus
GetSysColor
CallWindowProcA
GetWindowTextA
DefWindowProcA
GetClassInfoExA
RegisterClassExA
RegisterWindowMessageA
LoadCursorA
CreateDialogIndirectParamA
GetWindowLongA
GetParent
GetWindow
SystemParametersInfoA
LoadStringA
wvsprintfA
InvalidateRect
SetWindowLongA
GetWindowTextLengthA
gdi32
BitBlt
CreateCompatibleBitmap
DeleteObject
CreateCompatibleDC
GetObjectA
GetStockObject
CreateSolidBrush
DeleteDC
SelectObject
GetDeviceCaps
advapi32
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegCreateKeyExA
RegSetValueExA
RegDeleteKeyA
RegDeleteValueA
shell32
SHGetMalloc
SHGetSpecialFolderPathA
Shell_NotifyIconA
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetSpecialFolderLocation
ShellExecuteA
SHFileOperationA
ole32
CoTaskMemAlloc
OleUninitialize
CreateStreamOnHGlobal
OleInitialize
OleLockRunning
CLSIDFromProgID
CLSIDFromString
CoCreateInstance
CoTaskMemFree
StringFromCLSID
CoInitialize
CoUninitialize
oleaut32
SysStringLen
LoadRegTypeLi
SysAllocString
SysAllocStringLen
VariantClear
SysFreeString
OleCreateFontIndirect
Sections
.text Size: 76KB - Virtual size: 74KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 56KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ