Static task
static1
Behavioral task
behavioral1
Sample
eb707f014c7e077a525879ee7ee2d76c_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
eb707f014c7e077a525879ee7ee2d76c_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
eb707f014c7e077a525879ee7ee2d76c_JaffaCakes118
-
Size
521KB
-
MD5
eb707f014c7e077a525879ee7ee2d76c
-
SHA1
84d6c6c011b5fede2384e33da5d542a2926a7966
-
SHA256
cd14ed6707785de9c290f12d3f3f58c6c8520a24f2caf87f7297a210ac5b90f6
-
SHA512
3f919b8a11c86aaee16710fa033d277517c4133c8bbe83f551310b630883ea512b048910677a6ff22dce43257bf6685073775bd2be94db3f44cf820f0d31c7c1
-
SSDEEP
12288:mBTue6gwQ9uLxlhpoXuIwuHnWtoDdQgXSCpRM8Um:mxu/gwSuLxl8Xu7UKoDdXJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource eb707f014c7e077a525879ee7ee2d76c_JaffaCakes118
Files
-
eb707f014c7e077a525879ee7ee2d76c_JaffaCakes118.exe windows:4 windows x86 arch:x86
fea7bc7c1d311c444623be929b8780c7
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
SetWindowContextHelpId
RegisterClassA
DdeNameService
GetDlgItemTextW
EnumDisplayDevicesA
InflateRect
LoadKeyboardLayoutW
MapVirtualKeyExA
GetMenuInfo
EnumClipboardFormats
LookupIconIdFromDirectoryEx
DrawMenuBar
RedrawWindow
ValidateRgn
RegisterClassExA
GetDoubleClickTime
SubtractRect
TabbedTextOutA
SetWinEventHook
TileChildWindows
SetMenu
SendMessageA
kernel32
GetVersionExA
GetCurrentProcessId
GetLocaleInfoW
GetNamedPipeHandleStateA
TlsGetValue
GetCurrentThread
GetSystemInfo
HeapFree
GetStartupInfoA
LeaveCriticalSection
GetLocaleInfoA
GetProfileSectionW
GetModuleFileNameA
TlsAlloc
GetFileType
EnterCriticalSection
SetStdHandle
GetStringTypeA
SetEnvironmentVariableA
GetTickCount
CreateMutexA
GlobalCompact
GetTimeZoneInformation
GetEnvironmentStringsW
VirtualFree
CreateFileMappingW
FlushFileBuffers
FreeEnvironmentStringsW
lstrcatW
UnhandledExceptionFilter
InterlockedIncrement
VirtualAlloc
TlsFree
IsValidLocale
GetCurrentThreadId
CloseHandle
TerminateProcess
LCMapStringW
DeleteAtom
GetCommandLineA
SetHandleCount
InitializeCriticalSection
VirtualProtect
GetStringTypeW
OpenMutexA
LCMapStringA
FreeEnvironmentStringsA
VirtualQuery
SetLastError
GetModuleHandleA
LoadLibraryA
GetCurrentProcess
GetStdHandle
GetOEMCP
DeleteCriticalSection
FreeLibraryAndExitThread
RtlUnwind
GetAtomNameW
GetTimeFormatA
GetDateFormatA
SetLocaleInfoA
GetProcAddress
WideCharToMultiByte
GetUserDefaultLCID
IsValidCodePage
InterlockedExchange
ReadFile
GetSystemTimeAsFileTime
HeapReAlloc
GetACP
CompareStringW
HeapCreate
SetThreadContext
CreateDirectoryExA
HeapDestroy
CompareStringA
MultiByteToWideChar
ExitProcess
IsBadWritePtr
GetLastError
lstrcat
GetProcessHeaps
EnumSystemLocalesA
QueryPerformanceCounter
GetCPInfo
HeapSize
WriteFile
TlsSetValue
HeapAlloc
SetFilePointer
GetEnvironmentStrings
gdi32
SetEnhMetaFileBits
GetTextExtentPoint32A
RemoveFontResourceW
SelectClipRgn
DeleteDC
EnumFontFamiliesA
CreatePolyPolygonRgn
DescribePixelFormat
SetArcDirection
PolylineTo
CloseEnhMetaFile
GdiSetBatchLimit
SetPolyFillMode
ResizePalette
shell32
ShellHookProc
SHGetSettings
DragFinish
advapi32
DuplicateToken
RegSaveKeyW
RegQueryMultipleValuesA
RegEnumValueA
RegEnumKeyExW
RegOpenKeyA
RegSetValueExW
RegEnumKeyW
CryptDecrypt
RegLoadKeyA
InitiateSystemShutdownW
LookupPrivilegeDisplayNameW
CryptVerifySignatureA
RegSetValueExA
CryptGetHashParam
RegDeleteKeyA
StartServiceW
StartServiceA
CryptGetDefaultProviderA
CreateServiceA
CryptSetProvParam
comctl32
InitCommonControlsEx
wininet
FreeUrlCacheSpaceA
InternetQueryOptionW
HttpOpenRequestW
InternetConfirmZoneCrossingA
InternetReadFileExW
FindFirstUrlCacheGroup
InternetAlgIdToStringW
DetectAutoProxyUrl
Sections
.text Size: 184KB - Virtual size: 184KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 9KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 314KB - Virtual size: 313KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ