Static task
static1
Behavioral task
behavioral1
Sample
ebd858e241edcd8a3ecfa6474726b615_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
ebd858e241edcd8a3ecfa6474726b615_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
ebd858e241edcd8a3ecfa6474726b615_JaffaCakes118
-
Size
44KB
-
MD5
ebd858e241edcd8a3ecfa6474726b615
-
SHA1
116799139ea33221780a0ac0d9314c61bcb9bf66
-
SHA256
236055b281842936693e43457c9acd387369aed541c92f7acbd84d75cdd15720
-
SHA512
35f1e2105c019be1bc5784b24cff847dbf915a8e2bb95efc9d98c26f7bfc1da3ff4ba94aca93b65f7a14ecab79924be678eff9d82be0a6b1c625fedbd0d130b0
-
SSDEEP
768:9GvcHskNYOw57qUDdAqADuofLoROJlUsgGn/KSkt2KVoo/iuLWvTp1+yOeU7:8v4skNboAqADuaLoRO5vTp1+yOeU7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ebd858e241edcd8a3ecfa6474726b615_JaffaCakes118
Files
-
ebd858e241edcd8a3ecfa6474726b615_JaffaCakes118.exe windows:4 windows x86 arch:x86
efe898562a2bbee81e383167c6f3af67
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
modf
memmove
strncmp
sprintf
_ftol
rand
??3@YAXPAX@Z
strncpy
srand
_strnicmp
user32
CallWindowProcA
ReleaseDC
FillRect
GetSysColor
GetDC
DefWindowProcA
TrackMouseEvent
SendMessageA
GetParent
InvalidateRect
EndPaint
BeginPaint
PeekMessageA
LoadIconA
RegisterClassExA
GetClassInfoExA
MsgWaitForMultipleObjects
MessageBoxTimeoutA
MessageBoxA
PostMessageA
EnumChildWindows
KillTimer
MoveWindow
GetWindowRect
ShowWindow
EnableWindow
wsprintfA
TranslateMessage
LoadCursorA
DispatchMessageA
SetTimer
FindWindowExA
EnumWindows
GetWindowThreadProcessId
GetClassNameA
GetWindowTextA
IsWindowVisible
GetMessageA
kernel32
CreateWaitableTimerA
SetProcessWorkingSetSize
GetModuleHandleA
CloseHandle
Module32First
CreateToolhelp32Snapshot
GetTempPathA
GetSystemDirectoryA
SetWaitableTimer
CreateProcessA
CreateFileA
WriteFile
GetStartupInfoA
GetWindowsDirectoryA
WaitForSingleObject
GetTickCount
IsBadReadPtr
HeapFree
HeapReAlloc
HeapAlloc
ExitProcess
GetProcessHeap
RtlMoveMemory
lstrcpyn
LocalSize
shell32
SHGetSpecialFolderPathA
wininet
InternetOpenUrlA
InternetOpenA
InternetGetConnectedState
InternetReadFile
gdi32
GetObjectA
SelectObject
BitBlt
DeleteDC
CreateSolidBrush
CreateCompatibleDC
shlwapi
PathFileExistsA
Sections
.text Size: 28KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 664B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE