Static task
static1
Behavioral task
behavioral1
Sample
eacadd1d2aa253fb8c0acaaf47bcba72_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
eacadd1d2aa253fb8c0acaaf47bcba72_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
eacadd1d2aa253fb8c0acaaf47bcba72_JaffaCakes118
-
Size
168KB
-
MD5
eacadd1d2aa253fb8c0acaaf47bcba72
-
SHA1
0860f816ee43d2d4fd1b4827dd27fed42c2ae95e
-
SHA256
1b36b4b0179d25e1328360321ef9b3f4889b8a73d63d7f96a810d0a42007c4b9
-
SHA512
fbec2a7a351b29d408e554ec018f5df117087ee6c206465e43e34946184876875df268c38d0822beb61d1d9aa67c3d22139d9f33072b429561eb3584a0aeffc0
-
SSDEEP
3072:/R8wg3Le6k/QpgX/Z32qko4hwgKfXrEvrdaJv0GJLzo:/Rzke6k/zxLIwgKfX4dcv3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource eacadd1d2aa253fb8c0acaaf47bcba72_JaffaCakes118
Files
-
eacadd1d2aa253fb8c0acaaf47bcba72_JaffaCakes118.exe windows:4 windows x86 arch:x86
86bc741bf6c9c3daa21752729a251f2a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
user32
GetSystemMetrics
GetDesktopWindow
CharNextA
TranslateMessage
GetParent
GetDC
gdi32
DeleteObject
GetStockObject
GetPixel
CreateSolidBrush
SaveDC
CreateFontIndirectA
GetClipBox
GetDeviceCaps
SetTextAlign
CreatePalette
LineTo
RestoreDC
SelectObject
SetMapMode
SetStretchBltMode
RectVisible
GetTextMetricsA
CreatePen
PatBlt
SetTextColor
GetObjectA
SelectPalette
CreateCompatibleDC
DeleteDC
kernel32
GetCurrentProcess
GetOEMCP
GetProcessHeap
GetStartupInfoA
DeleteFileW
lstrlenW
GetACP
SetCurrentDirectoryA
QueryPerformanceCounter
lstrlenA
lstrcmpiW
GetModuleHandleW
lstrcmpiA
CopyFileA
lstrcmpA
GetDriveTypeA
GlobalFindAtomW
DeleteFileA
GetCurrentThreadId
MulDiv
GlobalFindAtomA
GetConsoleOutputCP
GetCurrentThread
GetCommandLineW
GetTickCount
GetWindowsDirectoryA
GetVersion
RemoveDirectoryA
GetUserDefaultLangID
GetCommandLineA
GetModuleHandleA
GetCurrentProcessId
VirtualAlloc
VirtualFree
GetThreadLocale
IsDebuggerPresent
glu32
gluNurbsCallback
Sections
.text Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Tymmb. F Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Aqa. Vos Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 99KB - Virtual size: 98KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ