Static task
static1
Behavioral task
behavioral1
Sample
01afe4df6db8524e2e9b4f851ad5052b_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
01afe4df6db8524e2e9b4f851ad5052b_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
01afe4df6db8524e2e9b4f851ad5052b_JaffaCakes118
-
Size
151KB
-
MD5
01afe4df6db8524e2e9b4f851ad5052b
-
SHA1
3a12857fa5510aada7fe2ef54d82101d82afa420
-
SHA256
d7f08febf2bdfa6ecc3b4dd7b26edd4878df32befdbad7a2b4c88f35c14353b7
-
SHA512
41a2d3d66622d0a7c01ffb5770b29dd819fd51732bbef698cd21417a5ca3ea0a60086997bbd3fdcf0021347a2e2a1f123ef7bb9b5b9e54b1c9e3d0801cc1a73a
-
SSDEEP
3072:lakTx5sNxuOLUzPOLpLSDu6L4oaMx5iDC+X:lakTxufAOLpLSDDL4Jx/X
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 01afe4df6db8524e2e9b4f851ad5052b_JaffaCakes118
Files
-
01afe4df6db8524e2e9b4f851ad5052b_JaffaCakes118.exe .vbs windows:4 windows x86 arch:x86 polyglot
932fe753a047b7925e098ba1cf324eeb
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
strncpy
malloc
free
modf
tolower
toupper
??3@YAXPAX@Z
strncmp
??2@YAPAXI@Z
_ftol
atoi
sprintf
_strnicmp
user32
SetTimer
MsgWaitForMultipleObjects
GetClassNameA
RegisterWindowMessageA
SendMessageTimeoutA
FindWindowExA
MessageBoxA
wsprintfA
DispatchMessageA
TranslateMessage
GetMessageA
PeekMessageA
kernel32
SetFileAttributesA
GetFileSize
ReadFile
GetModuleFileNameA
IsBadReadPtr
HeapFree
HeapReAlloc
HeapAlloc
ExitProcess
GetModuleHandleA
GetProcessHeap
SetWaitableTimer
CreateWaitableTimerA
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
DeleteFileA
Process32Next
WriteFile
MoveFileA
GetWindowsDirectoryA
GetSystemDirectoryA
GetTempPathA
CreateProcessA
OpenEventA
CreateEventA
SetProcessWorkingSetSize
CreateToolhelp32Snapshot
Process32First
CloseHandle
CreateFileA
shell32
ShellExecuteA
SHGetSpecialFolderPathA
oleacc
ObjectFromLresult
shlwapi
PathFileExistsA
ole32
CLSIDFromProgID
CLSIDFromString
CoCreateInstance
OleRun
CoUninitialize
CoInitialize
oleaut32
SafeArrayUnaccessData
SafeArrayGetElement
SafeArrayAccessData
VarR8FromBool
LoadTypeLi
RegisterTypeLi
SafeArrayCreate
SysAllocString
VarR8FromCy
VariantClear
SafeArrayDestroy
VariantChangeType
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
VariantInit
Sections
.text Size: 52KB - Virtual size: 50KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE