Static task
static1
Behavioral task
behavioral1
Sample
faf6ae0f3d0625461675118faa2a7f94_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
faf6ae0f3d0625461675118faa2a7f94_JaffaCakes118.exe
Resource
win10v2004-20240910-en
General
-
Target
faf6ae0f3d0625461675118faa2a7f94_JaffaCakes118
-
Size
212KB
-
MD5
faf6ae0f3d0625461675118faa2a7f94
-
SHA1
f3867b33050393e5d1f8a2f2bb7866ba1e2bf327
-
SHA256
8e18dd5aa3f643bdd51273afe93e2770928f325b2ff1156e3f0a6fbcaded0c72
-
SHA512
37b398f8cca2cc1451b41a9f33739372c4a2ce288a4f5dbfd9d357f9160c042d46647294d72df99175252ce6dc81b1f312f66e3ff0c358e3dd96b28f00664e3f
-
SSDEEP
3072:LCfO1Cs2+znJrbc5JyQg8jtIiBDfO3jKPyomAzlhMwCik2VNWiR:GAC2n9c5Jy185ILWKomAcik2VNH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource faf6ae0f3d0625461675118faa2a7f94_JaffaCakes118
Files
-
faf6ae0f3d0625461675118faa2a7f94_JaffaCakes118.exe windows:4 windows x86 arch:x86
02a16e2d360db53f4907d7967558fb36
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
gdi32
AbortDoc
CopyMetaFileA
CreateDIBitmap
CreateICA
CreatePatternBrush
CreateRoundRectRgn
ExtCreateRegion
GetBkColor
GetCharWidthW
GetDIBColorTable
GetDIBits
GetEnhMetaFileHeader
GetNearestPaletteIndex
GetPixel
GetRgnBox
GetStockObject
GetTextMetricsA
LineDDA
OffsetRgn
PtInRegion
SetBkMode
SetColorAdjustment
SetDIBColorTable
SetMetaFileBitsEx
SetTextJustification
StretchBlt
TextOutA
user32
DestroyMenu
DestroyWindow
EmptyClipboard
EndDialog
FillRect
GetDCEx
GetIconInfo
GetKeyState
GetKeyboardType
GetParent
GetScrollInfo
GetSystemMenu
IntersectRect
IsWindowEnabled
MessageBeep
OffsetRect
OpenClipboard
PtInRect
RegisterClassA
RegisterClipboardFormatA
SetRect
SetScrollRange
SetTimer
SetWindowLongA
SetWindowPos
ShowOwnedPopups
UnhookWindowsHookEx
wsprintfA
kernel32
CopyFileA
GetExitCodeProcess
GetFileSize
GetLocaleInfoA
GetPrivateProfileStringA
GetShortPathNameA
GetTempFileNameA
IsBadReadPtr
LCMapStringW
LeaveCriticalSection
SetEnvironmentVariableA
SetFileTime
SetThreadPriority
TerminateThread
TlsSetValue
UnmapViewOfFile
lstrcpyA
shell32
CommandLineToArgvW
DragAcceptFiles
DragFinish
DragQueryFileW
DragQueryPoint
ExtractIconExA
ExtractIconExW
SHAddToRecentDocs
SHAppBarMessage
SHBrowseForFolder
SHBrowseForFolderA
SHCreateDirectoryExA
SHCreateDirectoryExW
SHFileOperationW
SHGetDesktopFolder
SHGetFileInfoA
SHGetFolderPathA
SHGetMalloc
SHGetPathFromIDListA
SHGetSettings
SHGetSpecialFolderLocation
Shell_NotifyIconA
advapi32
AddAccessAllowedAce
CheckTokenMembership
CryptDestroyHash
CryptGenRandom
CryptHashData
FreeSid
LookupPrivilegeValueA
OpenServiceW
OpenThreadToken
RegCloseKey
RegCreateKeyExA
RegDeleteValueA
RegDeleteValueW
RegEnumKeyExW
RegEnumKeyW
RegEnumValueA
RegQueryValueExA
RegSetValueExW
RevertToSelf
ole32
CLSIDFromProgID
CoCreateGuid
CoDisconnectObject
CoMarshalInterThreadInterfaceInStream
CoRegisterClassObject
CoReleaseMarshalData
CoSetProxyBlanket
CoTaskMemFree
CreateBindCtx
CreateILockBytesOnHGlobal
DoDragDrop
GetRunningObjectTable
OleIsCurrentClipboard
OleSetMenuDescriptor
ProgIDFromCLSID
PropVariantClear
RevokeDragDrop
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
StringFromGUID2
comctl32
CreateToolbarEx
ImageList_GetBkColor
ImageList_GetDragImage
ImageList_GetIcon
ImageList_GetImageInfo
ImageList_SetBkColor
ImageList_SetIconSize
Sections
.text Size: 88KB - Virtual size: 88KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 99KB - Virtual size: 98KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
rspqv0Mk Size: 1KB - Virtual size: 120KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE