Static task
static1
Behavioral task
behavioral1
Sample
f567a1f49f95a4f13c96ef9e0f9b467c_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f567a1f49f95a4f13c96ef9e0f9b467c_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
f567a1f49f95a4f13c96ef9e0f9b467c_JaffaCakes118
-
Size
141KB
-
MD5
f567a1f49f95a4f13c96ef9e0f9b467c
-
SHA1
7be6beca0acbbde14bd56101655972eb65cbf0ef
-
SHA256
070872fa3a4746f3b920c4fc536987c7c13c6423b6f720ee5b1566234e5ad7de
-
SHA512
024ab83afc3a622c9500159cab1fef79cc3fcf3d53ae7f8bd8d22ac69d323e5ae04753f6a2272f4796f1adbe37afd9b9820bab1f992e0bf758564e5323a7bf4b
-
SSDEEP
3072:icr8dg+y57elue/mSDFZTuRsR2Tq0wDuW/jZS1eE7aVA/3Luhz/:P+nBTSQ0wfSHZLuhz/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f567a1f49f95a4f13c96ef9e0f9b467c_JaffaCakes118
Files
-
f567a1f49f95a4f13c96ef9e0f9b467c_JaffaCakes118.exe windows:5 windows x86 arch:x86
d8f80d6c0748ade32a8be7361185ae4f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
StrToIntW
PathFileExistsW
kernel32
GetProcAddress
GetModuleHandleA
LoadLibraryExW
FreeLibrary
lstrcpynW
GlobalAlloc
ExitProcess
GetPrivateProfileIntW
CloseHandle
ReadFile
CreateFileW
GetVolumeInformationW
SetErrorMode
GetDriveTypeW
lstrlenW
GetLogicalDrives
GetTickCount
CopyFileW
GetPrivateProfileStringW
GetModuleFileNameW
GetModuleHandleW
GetEnvironmentVariableW
MultiByteToWideChar
SetFilePointer
user32
SendMessageA
FindWindowA
SetForegroundWindow
GetAsyncKeyState
GetWindowTextW
FindWindowW
DispatchMessageA
GetMessageA
CreateWindowExA
MessageBoxA
RegisterClassA
RegisterWindowMessageA
CreatePopupMenu
GetCursorPos
InsertMenuItemW
SetMenuDefaultItem
EnableMenuItem
TrackPopupMenu
DestroyMenu
LoadImageW
DestroyIcon
DefWindowProcA
DestroyWindow
PostQuitMessage
CharNextW
CharPrevW
LoadStringW
LoadImageA
advapi32
RegCloseKey
RegQueryValueExW
RegOpenKeyW
RegDeleteValueW
shell32
SHGetSpecialFolderPathW
ShellExecuteW
Shell_NotifyIconW
msvcr90
free
_vsnwprintf
memset
malloc
Sections
.text Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 131KB - Virtual size: 132KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE