Static task
static1
Behavioral task
behavioral1
Sample
ea3547656dcc19f42fad0e9594bd3672_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ea3547656dcc19f42fad0e9594bd3672_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
ea3547656dcc19f42fad0e9594bd3672_JaffaCakes118
-
Size
162KB
-
MD5
ea3547656dcc19f42fad0e9594bd3672
-
SHA1
6ccc015abf8c0c9be6dabe74f477e943c05c1893
-
SHA256
96d77d0821219b31b73d07a16ecc5eb5c2f812a62d208a33e04b93ecb473c3ae
-
SHA512
a8683ece9996beaee6904e376f80a029773b72af50b5288bf946ba0f5604235da0186a4bf65b4b6184e9140a826eb8d98253ae2f45959665d0bd1c8b86b10388
-
SSDEEP
3072:NLVcHQs7ZtBEMso6I1894S3vasuE80DNpg9Ie1jQQ46sm:N2HQs7xsyw4USXE8eAIe1jQ16s
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ea3547656dcc19f42fad0e9594bd3672_JaffaCakes118
Files
-
ea3547656dcc19f42fad0e9594bd3672_JaffaCakes118.exe windows:4 windows x86 arch:x86
9e6c5295375715170bf8aafbcc9d82fb
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
SendMessageA
IsWindow
GetDlgItem
DestroyWindow
EnumChildWindows
CreateWindowExW
GetWindowThreadProcessId
kernel32
AddAtomA
IsBadWritePtr
TlsGetValue
TlsSetValue
VirtualAlloc
SetLastError
GetStdHandle
TlsFree
GetEnvironmentStringsW
HeapCreate
GetCurrentProcess
SetEndOfFile
GetEnvironmentStrings
SetHandleCount
HeapSize
GetFileType
FreeEnvironmentStringsA
EnumResourceNamesW
GetLocaleInfoA
FreeEnvironmentStringsW
GetSystemInfo
VirtualQuery
GetCPInfo
WriteFile
QueryPerformanceCounter
VirtualFree
HeapDestroy
lstrcatW
GetStartupInfoA
GetVersionExA
UnhandledExceptionFilter
GetOEMCP
InterlockedExchange
GetACP
GetModuleFileNameA
GetSystemTimeAsFileTime
GetCurrentProcessId
TlsAlloc
TerminateProcess
SetUnhandledExceptionFilter
iphlpapi
GetIpAddrTable
setupapi
CM_Get_Global_State
SetupDiGetDeviceRegistryPropertyW
CMP_WaitNoPendingInstallEvents
CM_Get_DevNode_Status
newdev
UpdateDriverForPlugAndPlayDevicesW
shell32
SHGetFolderPathW
mprapi
MprConfigServerDisconnect
MprConfigServerConnect
MprConfigGetFriendlyName
Sections
.text Size: 85KB - Virtual size: 488KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 74KB - Virtual size: 73KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ