Static task
static1
Behavioral task
behavioral1
Sample
e1a9868504ae268c9e5cfb2eabb9e4c7_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e1a9868504ae268c9e5cfb2eabb9e4c7_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
e1a9868504ae268c9e5cfb2eabb9e4c7_JaffaCakes118
-
Size
172KB
-
MD5
e1a9868504ae268c9e5cfb2eabb9e4c7
-
SHA1
68fe300dc62946eb19832874583763493b237d69
-
SHA256
4876da5d6ad3ec2afcf7397229c55c733c54966f959dbc46d22b4b6d75b11d5b
-
SHA512
5f02b635e37ad406aa27c78736c5d8b1e255db632eb81d960a2c515775e3e0e364f0bae54ddecef6d1a7d43fec3eafd23c17b77a595d1d90aa4cce0714008058
-
SSDEEP
3072:Wd+55AzoTqBm6JeD274nmzFXQcYCHkQSxjw:Wd+55AzoTqBPsmz5RYCE8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e1a9868504ae268c9e5cfb2eabb9e4c7_JaffaCakes118
Files
-
e1a9868504ae268c9e5cfb2eabb9e4c7_JaffaCakes118.exe windows:4 windows x86 arch:x86
7b0f5983dd17bce16a50bdbe5e15fa27
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
hpqmfc08
?InitHpoMfcDll@@YGXPAUHINSTANCE__@@@Z
version
VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
user32
IsIconic
DrawIcon
GetSystemMetrics
RedrawWindow
GetClientRect
LoadIconA
AppendMenuA
SetCursor
FindWindowA
SendMessageA
EnableWindow
LoadCursorA
MsgWaitForMultipleObjects
GetSystemMenu
GetWindowRect
mfc42
ord2982
ord3259
ord5277
ord2124
ord3147
ord3262
ord4465
ord3081
ord2976
ord3136
ord3830
ord3831
ord2985
ord3079
ord4080
ord3402
ord4424
ord3721
ord567
ord6453
ord2379
ord3825
ord4376
ord4998
ord2514
ord6052
ord1775
ord5280
ord4627
ord3597
ord324
ord641
ord4234
ord5265
ord4710
ord4853
ord1199
ord2820
ord3811
ord823
ord3337
ord1168
ord535
ord4673
ord4274
ord6375
ord4425
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord2725
ord4079
ord3092
ord5289
ord5714
ord4622
ord3738
ord815
ord561
ord5214
ord2621
ord858
ord5065
ord4486
ord5572
ord2915
ord1134
ord6650
ord6591
ord6807
ord6857
ord6823
ord6855
ord6832
ord6859
ord6867
ord6847
ord6814
ord6839
ord6846
ord6858
ord6816
ord6815
ord6812
ord6845
ord6856
ord6835
ord4589
ord5261
ord4899
ord4370
ord4892
ord6817
ord5076
ord4340
ord4347
ord4720
ord4889
ord4531
ord4545
ord4543
ord4526
ord4529
ord4524
ord4963
ord4960
ord4108
ord6054
ord5281
ord3748
ord1725
ord5260
ord6614
ord6691
ord4432
ord6514
ord4698
ord1146
ord6478
ord922
ord926
ord941
ord939
ord537
ord6797
ord4160
ord2863
ord6215
ord2642
ord5981
ord755
ord470
ord539
ord4202
ord6822
ord1727
ord2055
ord3749
ord6376
ord4837
ord2648
ord4441
ord4353
ord3798
ord5290
ord2385
ord6374
ord5163
ord1776
ord5241
ord4407
ord6241
ord4078
ord6055
ord2446
ord795
ord6880
ord860
ord6800
ord6597
ord2614
ord296
ord540
ord3663
ord617
ord800
ord4129
ord825
ord5683
ord5307
ord4588
ord1576
msvcrt
__set_app_type
__p__fmode
_controlfp
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
_onexit
__dllonexit
_except_handler3
toupper
_chdrive
_chdir
_getcwd
atoi
sprintf
strncmp
strstr
_mbscmp
memset
swprintf
strlen
__CxxFrameHandler
_mbsnbicmp
_setmbcp
kernel32
InterlockedExchange
RaiseException
lstrcmpiA
GetStartupInfoA
GetModuleHandleA
MultiByteToWideChar
GetVersionExA
GetModuleFileNameA
CreateProcessA
GetLastError
CloseHandle
GetLocaleInfoA
Sleep
SearchPathA
CreateFileA
GetProfileStringA
GlobalFree
lstrcpyA
GlobalLock
GlobalAlloc
GlobalUnlock
GetPrivateProfileStringA
LocalAlloc
LocalFree
LoadLibraryA
SetErrorMode
GetProcAddress
FreeLibrary
lstrlenA
advapi32
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
StartServiceA
CloseServiceHandle
OpenSCManagerA
OpenServiceA
QueryServiceStatus
ole32
CoUninitialize
CoCreateInstance
CoInitialize
Sections
.text Size: 24KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 132KB - Virtual size: 152KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE