Static task
static1
Behavioral task
behavioral1
Sample
dc730456f537fb0ec01570d47db04898_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
dc730456f537fb0ec01570d47db04898_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
dc730456f537fb0ec01570d47db04898_JaffaCakes118
-
Size
904KB
-
MD5
dc730456f537fb0ec01570d47db04898
-
SHA1
0345a1f9050d022c857b19e2f5756a9476840ce2
-
SHA256
7ff78711a80a75f3f80683048e2bca0fbfa5ec3e6de870caa7fe9ff9e2dea929
-
SHA512
87054896e24937220f50a73d8f645e2527c839596b252ab651dbb88d0f837bb679ae521b8cf3eefbce57e5a0cd46856a3a11c365d4c6079b85fc7b4e239a30ee
-
SSDEEP
12288:mloWCWJkqMgFZ1n5RJvcHtmSVTUmVlAg1bsjXKhRdc/2/qcPRS4zW5cSISCiS:mlokTtnnJEN7omVpsjXcp/q8RZq5USTS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dc730456f537fb0ec01570d47db04898_JaffaCakes118
Files
-
dc730456f537fb0ec01570d47db04898_JaffaCakes118.exe windows:4 windows x86 arch:x86
3e139750f3f923769ab91a9d42c5b3c4
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
Imports
advapi32
CryptAcquireContextW
CryptDestroyHash
GetUserNameW
RegCreateKeyExA
RegEnumKeyExA
RegQueryValueExA
RegSetValueExA
kernel32
InitializeCriticalSection
shlwapi
PathFileExistsW
SHDeleteKeyA
StrCmpNIA
StrStrW
wnsprintfW
wvnsprintfA
user32
CharLowerBuffA
CloseDesktop
GetDlgItemTextA
GetIconInfo
GetWindowTextA
MsgWaitForMultipleObjects
PeekMessageA
ToUnicode
Sections
.bangj Size: 43KB - Virtual size: 60KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.qzkluv Size: 1024B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.nwr Size: 5KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ