Static task
static1
Behavioral task
behavioral1
Sample
e792b6ea1278150e6dab1f051afb1e53_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e792b6ea1278150e6dab1f051afb1e53_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
e792b6ea1278150e6dab1f051afb1e53_JaffaCakes118
-
Size
275KB
-
MD5
e792b6ea1278150e6dab1f051afb1e53
-
SHA1
965effb5043ca4c801db0042e9a298695e7776c0
-
SHA256
04b53add75e977ed6f3fc7e703c8713230182f87311d83249e27e21cbc964192
-
SHA512
f6ff6df92a244961b8a231a0a34e0f776850afc2e58461d297b9e74cc138f0936f6d17a2d2c7c33c9e6f463900cae0ca71399a281c815a5746b6492298ac641e
-
SSDEEP
6144:ZSYXOR3qfv+Ctu3iFCh/mCYSIWtgeAEOlJUuONGhmdTNY:ZSYgiV6iFC5rpVdOlSFcmZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e792b6ea1278150e6dab1f051afb1e53_JaffaCakes118
Files
-
e792b6ea1278150e6dab1f051afb1e53_JaffaCakes118.exe windows:4 windows x86 arch:x86
d43d7ecd149fc166c7b5e00b7fbac146
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GlobalSize
lstrlenW
Sleep
GlobalFree
GlobalGetAtomNameA
FindFirstFileW
DeleteFileW
lstrcmpW
GetPrivateProfileStringW
GetVersionExA
GetModuleHandleW
LoadLibraryA
GetLastError
lstrcpyW
GlobalUnlock
GetProcAddress
WritePrivateProfileStringW
GlobalLock
LockResource
GetFileAttributesW
MultiByteToWideChar
FindResourceW
EnumResourceTypesA
FindNextChangeNotification
LoadResource
GetCurrentDirectoryW
FindCloseChangeNotification
FileTimeToLocalFileTime
FreeLibrary
GetCurrentThreadId
DeleteCriticalSection
GetVersion
IsValidCodePage
GetModuleFileNameW
GetPrivateProfileIntW
WaitForSingleObject
GetVersionExW
LoadLibraryW
GlobalAlloc
GetLocaleInfoW
LoadLibraryExW
InterlockedIncrement
FindFirstChangeNotificationW
SetFileAttributesW
FindClose
FileTimeToSystemTime
GetTickCount
WideCharToMultiByte
CloseHandle
MulDiv
lstrcpynW
InitializeCriticalSection
ResumeThread
SetThreadPriority
shell32
SHIsFileAvailableOffline
SHGetFolderPathW
SHGetFileInfoA
CommandLineToArgvW
SHFileOperationW
ShellExecuteW
ShellExecuteExW
SHBrowseForFolderA
SHGetPathFromIDListA
ShellExecuteExA
Shell_NotifyIconA
Sections
.text Size: 127KB - Virtual size: 127KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 137KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 144KB - Virtual size: 144KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ