Static task
static1
Behavioral task
behavioral1
Sample
fbe3356eb2e7fca9b1c3de16f36e94fa_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fbe3356eb2e7fca9b1c3de16f36e94fa_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
fbe3356eb2e7fca9b1c3de16f36e94fa_JaffaCakes118
-
Size
169KB
-
MD5
fbe3356eb2e7fca9b1c3de16f36e94fa
-
SHA1
31710b687f9494fe9e062c44603adc0d443b2b96
-
SHA256
1cd84897f1c907528e055af5c478ce38f30caef60d451b2bc3495a552193ccb7
-
SHA512
56ce01a5c3341a82e4a0f429b05fd4811aad36df6879ba0dde3f918990b01841868eada30b192e3260aba5faa8780ebb956c59b19219e2560be51d72fea8860a
-
SSDEEP
3072:/MU58z6tpnMm35P5+OWbn7rTZWNhvS2qOy:/MSS6tJwOWbnjYhvu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fbe3356eb2e7fca9b1c3de16f36e94fa_JaffaCakes118
Files
-
fbe3356eb2e7fca9b1c3de16f36e94fa_JaffaCakes118.exe windows:5 windows x86 arch:x86
1c7e6509bf0460e83ed76df2ed7a1408
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
MulDiv
GetStartupInfoA
GlobalFindAtomW
GlobalFindAtomA
DeleteFileA
GetModuleHandleA
GetWindowsDirectoryA
lstrcmpiW
GetUserDefaultLangID
SetCurrentDirectoryA
GetCurrentProcessId
GetProcessHeap
IsDebuggerPresent
lstrlenW
VirtualAlloc
DeleteFileW
lstrlenA
GetTickCount
GetCurrentThread
GetConsoleOutputCP
VirtualFree
GetVersion
CopyFileA
GetThreadLocale
GetCommandLineA
GetCurrentThreadId
RemoveDirectoryA
GetOEMCP
GetACP
QueryPerformanceCounter
GetModuleHandleW
lstrcmpiA
GetCommandLineW
lstrcmpA
user32
GetParent
GetDesktopWindow
GetSystemMetrics
GetDC
TranslateMessage
CharNextA
gdi32
CreateFontIndirectA
RestoreDC
RectVisible
GetClipBox
GetStockObject
SetStretchBltMode
GetObjectA
SelectPalette
CreatePalette
CreateSolidBrush
SelectObject
SetTextAlign
CreateCompatibleDC
LineTo
SetTextColor
DeleteDC
GetDeviceCaps
SetMapMode
SaveDC
GetTextMetricsA
GetPixel
PatBlt
DeleteObject
CreatePen
glu32
gluNurbsCallback
Sections
.text Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Gfequdmh Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Nalvd, P Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 102KB - Virtual size: 101KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 29KB - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE