Static task
static1
Behavioral task
behavioral1
Sample
ffc397bfa4dd816569baf11b072fe21a_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ffc397bfa4dd816569baf11b072fe21a_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
ffc397bfa4dd816569baf11b072fe21a_JaffaCakes118
-
Size
40KB
-
MD5
ffc397bfa4dd816569baf11b072fe21a
-
SHA1
b5107d31a2c2ddeb452bfebc20452df55927f8b0
-
SHA256
9d5b4bccbc73f449187ee3ec0eae701842d153251acb6d91981c160d9c6aa5f1
-
SHA512
37fe4c8bcb059fc78f1a4d1f51712c1b323ce117af58349762c57380c5467dbe9386936e2dbb6f82bc2ad0a7dc809407a6d0cdc527f927c607ef970091de7797
-
SSDEEP
768:r/PivGdEvA8+ZpqyqwrFVTXxxserrFd6/xRygped/m0agrIGg:7PivGdEvA8+myqwbTXxxserrFdQxRyg1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ffc397bfa4dd816569baf11b072fe21a_JaffaCakes118
Files
-
ffc397bfa4dd816569baf11b072fe21a_JaffaCakes118.exe windows:4 windows x86 arch:x86
66513347b55e2a9855017b3f12c04e0a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord3831
ord3825
ord3079
ord4080
ord4622
ord4424
ord3738
ord561
ord815
ord2514
ord1247
ord1134
ord641
ord825
ord540
ord800
ord858
ord3499
ord2515
ord4129
ord5683
ord355
ord860
ord5953
ord6199
ord3092
ord924
ord6334
ord5265
ord4998
ord6052
ord4078
ord1775
ord4407
ord5241
ord2385
ord5163
ord6374
ord4353
ord5280
ord3798
ord4837
ord4441
ord2648
ord3830
ord6376
ord3749
ord5065
ord1727
ord5261
ord2446
ord2124
ord5277
ord4627
ord4425
ord3597
ord324
ord2370
ord4234
ord4710
ord755
ord470
ord4376
ord6453
ord1200
ord4224
ord1168
ord2379
ord1146
ord5810
ord5481
ord2031
ord4335
ord4863
ord5796
ord5478
ord1971
ord966
ord3570
ord278
ord605
ord4919
ord1638
ord4975
ord4447
ord4411
ord2029
ord2077
ord823
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5714
ord5289
ord5307
ord4698
ord4079
ord2725
ord5302
ord5300
ord3346
ord2396
ord5199
ord1089
ord3922
ord5731
ord2512
ord2554
ord4486
ord6375
ord4274
ord2055
ord4673
ord1576
msvcrt
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
_onexit
__dllonexit
memset
strstr
strncmp
strcmp
sprintf
_ftol
strchr
memcpy
strlen
strncpy
strcpy
strcat
_setmbcp
__CxxFrameHandler
_EH_prolog
_controlfp
kernel32
Beep
CloseHandle
WaitForSingleObject
GetProcAddress
GetFileAttributesA
FindClose
FindNextFileA
FindFirstFileA
UnmapViewOfFile
MapViewOfFile
OpenFileMappingA
CreateFileMappingA
Sleep
QueryPerformanceCounter
GetTickCount
FreeLibrary
LoadLibraryA
VirtualProtectEx
VirtualFreeEx
VirtualAllocEx
CreateRemoteThread
WriteProcessMemory
lstrlenA
GetStartupInfoA
CreateThread
GetModuleFileNameA
GetModuleHandleA
user32
LoadIconA
GetKeyState
GetAsyncKeyState
PostMessageA
SetDlgItemTextA
SetWindowTextA
GetWindowTextA
MessageBoxA
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExA
DispatchMessageA
EnableWindow
KillTimer
SetTimer
SetWindowLongA
GetWindowLongA
ReleaseDC
GetWindowDC
GetWindow
GetDesktopWindow
GetForegroundWindow
SendMessageA
DrawIcon
GetWindowThreadProcessId
IsIconic
GetSystemMetrics
GetClientRect
gdi32
TextOutA
shell32
ShellExecuteA
wsock32
shutdown
Sections
.text Size: 20KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 688B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ