Static task
static1
Behavioral task
behavioral1
Sample
df7004566bd1250ad7912571bbeb3d47_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
df7004566bd1250ad7912571bbeb3d47_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
df7004566bd1250ad7912571bbeb3d47_JaffaCakes118
-
Size
278KB
-
MD5
df7004566bd1250ad7912571bbeb3d47
-
SHA1
7ecda9cdd006e84f48b0c6e9890a882127878d0d
-
SHA256
e441a984525d5fd2cd17bcb90bc4a9bd77469acee48fe800802e60c2c1529a28
-
SHA512
9478a75444bba9e35c58027c191fe75d242e968b5d9c4ee851d6bda075b73ed22f297c291726bac9c2682c8c4f92fcea134f378296a41ab5446065d81bad45ab
-
SSDEEP
6144:/bYJKT03oCUI8y+tTVB9pDtF4/hWYq8KG1t4qeiiw:/XoUI8PVLpDtGwYMxi/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource df7004566bd1250ad7912571bbeb3d47_JaffaCakes118
Files
-
df7004566bd1250ad7912571bbeb3d47_JaffaCakes118.exe windows:4 windows x86 arch:x86
5381f0a66dd8a3a75e81bd6394d374e1
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
comctl32
ImageList_DragLeave
ImageList_DragMove
ImageList_DragEnter
shell32
SHGetFolderPathW
shlwapi
StrCmpNIA
StrStrA
iphlpapi
GetIpAddrTable
kernel32
InterlockedIncrement
GetSystemInfo
LeaveCriticalSection
InterlockedDecrement
GlobalAlloc
AddAtomA
SetThreadPriority
EnterCriticalSection
TerminateThread
CreateFileW
GetCurrentProcessId
GetProcAddress
CreateSemaphoreA
ResetEvent
lstrlenA
GetExitCodeThread
GetCurrentThread
GetSystemTime
LockResource
LoadLibraryW
FreeLibrary
GetLastError
Sleep
GetProcessHeap
QueryPerformanceCounter
MultiByteToWideChar
ReleaseSemaphore
EnumResourceTypesW
GetTickCount
IsBadWritePtr
GetGeoInfoA
VirtualFree
DisableThreadLibraryCalls
IsBadReadPtr
WaitForMultipleObjects
GetThreadPriority
VirtualAlloc
HeapFree
FindResourceA
GetModuleFileNameW
ReleaseMutex
CreateMutexA
LoadLibraryA
LoadResource
GetModuleFileNameA
GetCurrentThreadId
WideCharToMultiByte
ExitProcess
newdev
UpdateDriverForPlugAndPlayDevicesW
setupapi
CM_Get_Sibling
SetupDiGetDeviceRegistryPropertyW
CMP_WaitNoPendingInstallEvents
CM_Get_DevNode_Status
Sections
.text Size: 136KB - Virtual size: 272KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 138KB - Virtual size: 138KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ