Static task
static1
Behavioral task
behavioral1
Sample
df2febc8fa53c304ad74245392750cd3_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
df2febc8fa53c304ad74245392750cd3_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
df2febc8fa53c304ad74245392750cd3_JaffaCakes118
-
Size
94KB
-
MD5
df2febc8fa53c304ad74245392750cd3
-
SHA1
b2b25936259eab00e4c86939bae8eb89e58a9147
-
SHA256
7c666a6b38b6ba5a1f0aa46f3a13de4d6349c4bad71ce6814d194bb6758e882d
-
SHA512
96765f05a855582d3e3658f1c94cf603660f9f0975f98a51166297d91676f8b5ba391c4f38cb0af5cab6958589875b73d2a24ebffc8186ed0500f38432867f77
-
SSDEEP
1536:vys8QajqkoREDDkGZ8/GW/ZUvM7SHHY6vWwzSvMiGcoMfz8bZ7lcZxV7LberBojL:qs0jEREDFiGWRJM46vZzSUMfIbZ7lmp3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource df2febc8fa53c304ad74245392750cd3_JaffaCakes118
Files
-
df2febc8fa53c304ad74245392750cd3_JaffaCakes118.exe windows:4 windows x86 arch:x86
90143c34e59832b6c7c15b0085bfdc02
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcAddress
LockResource
FindResourceW
DeviceIoControl
LoadResource
GetCurrentThreadId
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
HeapReAlloc
HeapAlloc
GetOEMCP
GetACP
LoadLibraryA
WriteFile
RtlUnwind
HeapFree
VirtualFree
HeapCreate
HeapDestroy
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetModuleFileNameA
UnhandledExceptionFilter
GetCurrentProcess
VirtualAlloc
lstrcmpiA
GetModuleHandleA
TlsAlloc
GetVersion
GetCurrentProcessId
GetCPInfo
TerminateProcess
ExitProcess
GetCommandLineA
GetStartupInfoA
GetStringTypeW
user32
GetSystemMetrics
GetClientRect
MessageBoxA
EndDialog
LoadCursorA
LoadAcceleratorsA
GetMessageA
TranslateAcceleratorA
TranslateMessage
DispatchMessageA
RegisterClassExA
DefWindowProcA
FindWindowA
DialogBoxParamW
DestroyWindow
CreateWindowExA
ShowWindow
UpdateWindow
LoadStringA
GetSysColor
GetSysColorBrush
gdi32
CreateBitmap
Rectangle
advapi32
RegOpenKeyExA
RegSetValueExW
shell32
StrStrIA
ole32
CoInitialize
CoUninitialize
CoTaskMemAlloc
shlwapi
PathFileExistsA
Sections
.text Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.CODEA Size: 51KB - Virtual size: 50KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 171B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 20B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ