Static task
static1
Behavioral task
behavioral1
Sample
dfbf0faff52ed47cac4195a0f1ab3031_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
dfbf0faff52ed47cac4195a0f1ab3031_JaffaCakes118.exe
Resource
win10v2004-20240910-en
General
-
Target
dfbf0faff52ed47cac4195a0f1ab3031_JaffaCakes118
-
Size
427KB
-
MD5
dfbf0faff52ed47cac4195a0f1ab3031
-
SHA1
332a1db5bfd63ec67682ae0af8e59877b44a74d5
-
SHA256
8b5b4bbabafac312369d1b4f0e5b6d6a767ec6fb2fb60b003dee5b91decaa0d2
-
SHA512
08a6600e1038ee37b618083becff3b179fce3377f3d42f31df15bab38b4599c7a75a749d303c3b41fcabbf07142f286e8abdaa775f73ab3aa2c4cea456e9aa79
-
SSDEEP
12288:By+3jeunq+yxgpKB6IH4v+UQ+pnUDzmZ:BJ6gQ4bQ+pnWC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dfbf0faff52ed47cac4195a0f1ab3031_JaffaCakes118
Files
-
dfbf0faff52ed47cac4195a0f1ab3031_JaffaCakes118.exe windows:5 windows x86 arch:x86
a3d6016c350bfa51ad4df42599b5c10b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
wcsstr
wcscat
_wcsupr
malloc
_wcsicmp
free
_wtoi
wcschr
memmove
_except_handler3
_wtol
wcsncpy
wcscmp
iswctype
wcslen
wcscpy
kernel32
GetProcAddress
LoadLibraryA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
WideCharToMultiByte
GetLastError
GetOEMCP
MultiByteToWideChar
GlobalUnlock
GlobalLock
GlobalAlloc
FreeResource
SizeofResource
LockResource
LoadResource
GlobalFree
FreeLibrary
CloseHandle
GetNumberFormatA
GetFileSize
FileTimeToSystemTime
GetFileTime
GetUserDefaultLCID
GetVersionExA
lstrlenW
user32
EnableWindow
GetDlgItem
CheckRadioButton
GetWindowRect
MoveWindow
GetParent
EndDialog
GetDesktopWindow
SetFocus
CheckDlgButton
MessageBeep
IsDlgButtonChecked
ShowWindow
advapi32
RegQueryValueExA
RegCloseKey
RegFlushKey
RegOpenKeyExA
sqlunirl
_SetWindowText@8
_GetUnicodeRedirectionLayer@0
_GetModuleFileName@12
_CreateFile@28
_GetProcAddress_@8
_LoadLibrary@4
_GetWindowTextLength@4
_SendDlgItemMessage@20
_LoadIcon@8
_FindResource@12
_SetDlgItemText@12
_MAKEINTRESOURCE@4
_PostMessage@16
_SendMessage@16
_SetProp@12
_RemoveProp@8
_MessageBox@16
_GetWindowLong@8
_SetWindowLong@12
_CallWindowProc@20
_CharUpper@4
_GetWindowText@12
_LoadString@16
_GetProp@8
Sections
.text Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 98KB - Virtual size: 97KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 95KB - Virtual size: 94KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 1024B - Virtual size: 13B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ndata Size: 95KB - Virtual size: 94KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.push Size: 1024B - Virtual size: 101B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ik Size: 1024B - Virtual size: 5B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.susa Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.kkkk Size: 1024B - Virtual size: 468B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imho Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.dcode Size: 1024B - Virtual size: 174B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ocode Size: 1024B - Virtual size: 86B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.mcode Size: 1024B - Virtual size: 214B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.kpack Size: 1024B - Virtual size: 58B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.kpack0 Size: 1024B - Virtual size: 62B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.masm Size: 95KB - Virtual size: 94KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.buga Size: 1024B - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.alert Size: 1024B - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 1024B - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 296B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ