Static task
static1
Behavioral task
behavioral1
Sample
ead95ae109cac880f189f25a6ee67956_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ead95ae109cac880f189f25a6ee67956_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
ead95ae109cac880f189f25a6ee67956_JaffaCakes118
-
Size
169KB
-
MD5
ead95ae109cac880f189f25a6ee67956
-
SHA1
69ea84482121ac29c04cff48c5e332bd6d0bb195
-
SHA256
973ef6532c046fec051786c1554aaa551a5aca4c0665bb68b39fc5096266d1e5
-
SHA512
f5fb12c00101bf4882ba315df9ccaf5e35845695eccb36b567e889af89d2eb7f40305139d6941bd0e61eba9686ac42fda9c31932bf48080f4d8d386d60de227a
-
SSDEEP
3072:p+1XL18eyHxT/3jl58lIUpFtSmdxpZTOqzHdws9m55J7gqXkRvc1Hlw7b:QWHFR2IUootrHasu52mkRvc14
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ead95ae109cac880f189f25a6ee67956_JaffaCakes118
Files
-
ead95ae109cac880f189f25a6ee67956_JaffaCakes118.exe windows:4 windows x86 arch:x86
0f1ea0a128a8e964cafecb7df99fa9f0
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
shell32
SHGetFolderPathW
user32
EnumChildWindows
CreateWindowExW
DestroyWindow
IsWindow
SendMessageA
GetDlgItem
GetWindowThreadProcessId
newdev
UpdateDriverForPlugAndPlayDevicesW
iphlpapi
GetIpAddrTable
kernel32
SetHandleCount
GetCPInfo
VirtualAlloc
TerminateProcess
GetVersionExA
AddAtomA
TlsFree
GetCurrentProcessId
GetModuleFileNameA
GetStdHandle
VirtualQuery
HeapDestroy
GetEnvironmentStringsW
VirtualFree
GetSystemTimeAsFileTime
HeapCreate
GetCurrentProcess
TlsGetValue
QueryPerformanceCounter
SetEndOfFile
InterlockedExchange
GetLocaleInfoA
EnumResourceNamesA
TlsSetValue
lstrcatA
FreeEnvironmentStringsA
GetEnvironmentStrings
GetOEMCP
GetStartupInfoA
FreeEnvironmentStringsW
WriteFile
HeapSize
GetFileType
IsBadWritePtr
TlsAlloc
GetACP
SetLastError
UnhandledExceptionFilter
GetSystemInfo
SetUnhandledExceptionFilter
setupapi
CM_Get_Global_State
SetupDiGetDeviceRegistryPropertyW
CMP_WaitNoPendingInstallEvents
CM_Get_DevNode_Status
mprapi
MprConfigServerConnect
MprConfigServerDisconnect
MprConfigGetFriendlyName
Sections
.text Size: 86KB - Virtual size: 486KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 79KB - Virtual size: 78KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ