Static task
static1
Behavioral task
behavioral1
Sample
fd99e30120a23d1e82b75d3c916ab3d7_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fd99e30120a23d1e82b75d3c916ab3d7_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
fd99e30120a23d1e82b75d3c916ab3d7_JaffaCakes118
-
Size
477KB
-
MD5
fd99e30120a23d1e82b75d3c916ab3d7
-
SHA1
6921f5b4f0dd557f98dda0dd555c8210e96c1865
-
SHA256
a8db6695926ff93fe490cfc2bb986e947c5fbb52ae95b6721214aa4f0baba5e6
-
SHA512
7282a21c496894591cc1590dbb47950b60be64c111e986ab4da44e0de2425edbaaa8a17eb4ef52255d1754cbea0b0d1a416b1bb824fb60a5c6c59963fd54a95c
-
SSDEEP
3072:NjWEQ/FddEStqKJseuD80J0RW3+f6os0pdhV:NjNYFddES41trJ0RzHbV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fd99e30120a23d1e82b75d3c916ab3d7_JaffaCakes118
Files
-
fd99e30120a23d1e82b75d3c916ab3d7_JaffaCakes118.exe windows:4 windows x86 arch:x86
62e3cfe9e2688178e799d8b09710b3c0
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FindClose
FindNextFileA
FindFirstFileA
ReadProcessMemory
GetCurrentProcess
GetProcAddress
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersionExA
user32
LoadStringA
RegisterClassExA
LoadCursorA
LoadAcceleratorsA
UpdateWindow
ShowWindow
CreateWindowExA
PostQuitMessage
EndPaint
DrawTextA
GetClientRect
BeginPaint
DialogBoxParamA
DestroyWindow
DefWindowProcA
EndDialog
GetMessageA
TranslateAcceleratorA
TranslateMessage
DispatchMessageA
CharNextA
LoadIconA
msvcrt
strlen
strcat
strcpy
memcpy
strrchr
Sections
.text Size: 152KB - Virtual size: 152KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 200KB - Virtual size: 200KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 112KB - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.aspack Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.khe Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE