Static task
static1
Behavioral task
behavioral1
Sample
eb1c718f657923ced3f574b8655df356_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
eb1c718f657923ced3f574b8655df356_JaffaCakes118.exe
Resource
win10v2004-20240910-en
General
-
Target
eb1c718f657923ced3f574b8655df356_JaffaCakes118
-
Size
245KB
-
MD5
eb1c718f657923ced3f574b8655df356
-
SHA1
336eadf86d08d156d3090b79f391c48b7ca94f2a
-
SHA256
7f2172a3d12ad49ec872870fdd5645f8059123cb021cfb93a733cde36d095da9
-
SHA512
e5bd2d561eda286d8d36a07d7f7e37e65fa9b23007438e3164c75f02069b2638a06d77f5401fcf9f98b82f215eb9fdf77aa3a5100e186a4e683835cdc84eb934
-
SSDEEP
6144:hBCb2cOL7SLMOQi9gvjVNQQjIwfQqsDbxRA0U:hBChWIOvjV61LA0U
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource eb1c718f657923ced3f574b8655df356_JaffaCakes118
Files
-
eb1c718f657923ced3f574b8655df356_JaffaCakes118.exe windows:4 windows x86 arch:x86
d5a135f8c296d945b7d5ebc9ab561847
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
psapi
EnumProcesses
EnumProcessModules
GetModuleFileNameExA
comctl32
InitCommonControlsEx
oleaut32
SysAllocString
SysFreeString
shlwapi
PathFindFileNameW
user32
GetCursorPos
GetDesktopWindow
RedrawWindow
RemovePropW
SendMessageW
FindWindowW
GetAncestor
SetWindowLongW
GetWindowRect
ExitWindowsEx
GetParent
GetSysColor
MessageBoxW
CopyRect
SetPropW
ScreenToClient
GetWindowLongW
EnableWindow
IsWindow
FillRect
LoadCursorW
DrawTextW
PostMessageW
SetWindowPos
SystemParametersInfoW
SetCursor
ClientToScreen
PtInRect
SetForegroundWindow
IsWindowVisible
GetPropW
GetClientRect
gdi32
SetBkMode
BitBlt
CreateFontIndirectW
DeleteDC
LineTo
DeleteObject
GetTextExtentPoint32W
CreatePen
CreateCompatibleBitmap
CreateCompatibleDC
SetBkColor
GetStockObject
SelectObject
GetTextMetricsW
SetTextJustification
SetTextColor
MoveToEx
GetCurrentObject
GetObjectW
CreateSolidBrush
kernel32
ResetEvent
GetCurrentThreadId
EnterCriticalSection
CreateThread
GetProcessTimes
WriteFile
SetFilePointer
OpenMutexW
IsDebuggerPresent
LeaveCriticalSection
CreateProcessW
UnhandledExceptionFilter
CreateDirectoryW
FindFirstFileW
VirtualQuery
ReleaseMutex
CreateMutexW
GetModuleHandleW
CreateFileW
UnmapViewOfFile
GetSystemTimeAsFileTime
GetCommandLineW
MapViewOfFile
FreeLibrary
OpenProcess
DeleteFileW
SetLastError
FindClose
OpenEventW
WaitForSingleObject
DeleteCriticalSection
GetLocalTime
OpenFileMappingW
CloseHandle
FindNextFileW
SetUnhandledExceptionFilter
FormatMessageA
VirtualAlloc
shell32
ShellExecuteW
SHGetFolderPathW
advapi32
LookupPrivilegeValueW
RegOpenKeyExW
RegCloseKey
AdjustTokenPrivileges
OpenProcessToken
RegQueryValueExW
GetUserNameW
odbccp32
SQLGetPrivateProfileString
SelectTransDlg
SQLInstallTranslator
SQLRemoveDriverW
SQLGetPrivateProfileStringW
SQLWriteFileDSN
aclui
EditSecurity
Sections
.text Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.SOEtb Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.L Size: 1KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.QtQRi Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idgF Size: 512B - Virtual size: 318B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gd Size: 512B - Virtual size: 619B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rlWBHG Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 213KB - Virtual size: 428KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 924B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ