Static task
static1
Behavioral task
behavioral1
Sample
dee4876c70f55a1259b064f9316c5b0e_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
dee4876c70f55a1259b064f9316c5b0e_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
dee4876c70f55a1259b064f9316c5b0e_JaffaCakes118
-
Size
283KB
-
MD5
dee4876c70f55a1259b064f9316c5b0e
-
SHA1
3771114c6f0994148011a1e51b372eff6bf2eae4
-
SHA256
5c95098911c9c89189723420d0f08892162c2c5f55d24384e59f2ddd2056a960
-
SHA512
7682ae13579a0c50e2e4d6dc2d2cbd47d7e76798b54f350ab452b9b85478de641a1ac23aa389c54c5cb1ad38da81a83e33de97054e9f86cc92880db7d2cfac23
-
SSDEEP
6144:NDuBe0IxJXxtlr+k2hGuT7iUxeKmL2v8g6Y8ha:RuBeNtlr+khuT7ir296YCa
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dee4876c70f55a1259b064f9316c5b0e_JaffaCakes118
Files
-
dee4876c70f55a1259b064f9316c5b0e_JaffaCakes118.exe windows:4 windows x86 arch:x86
4245d0072a6f5bbc3db640c2bff905f8
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
EnumChildWindows
IsWindow
SendMessageA
CreateWindowExW
GetDlgItem
DestroyWindow
GetWindowThreadProcessId
mprapi
MprConfigServerConnect
MprConfigServerDisconnect
MprConfigGetFriendlyName
iphlpapi
GetIpAddrTable
shell32
SHGetFolderPathW
newdev
UpdateDriverForPlugAndPlayDevicesW
kernel32
AddAtomA
SetLastError
QueryPerformanceCounter
SetEndOfFile
GetEnvironmentStrings
TerminateProcess
GetStdHandle
InterlockedExchange
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetModuleFileNameA
IsBadWritePtr
GetLocaleInfoA
VirtualAlloc
GetSystemTimeAsFileTime
GetStartupInfoA
VirtualFree
VirtualQuery
HeapCreate
FreeEnvironmentStringsW
EnumResourceLanguagesA
GetSystemInfo
HeapSize
TlsSetValue
TlsAlloc
GetEnvironmentStringsW
SetHandleCount
lstrcpyW
TlsGetValue
WriteFile
HeapDestroy
GetFileType
GetACP
GetVersionExA
GetOEMCP
TlsFree
GetCPInfo
GetCurrentProcess
GetCurrentProcessId
SetUnhandledExceptionFilter
setupapi
CM_Get_Parent
CMP_WaitNoPendingInstallEvents
SetupDiGetDeviceRegistryPropertyW
CM_Get_DevNode_Status
Sections
.text Size: 142KB - Virtual size: 274KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 137KB - Virtual size: 136KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ