Static task
static1
Behavioral task
behavioral1
Sample
02bbb76dd29920ab530d2dabd0204db0_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
02bbb76dd29920ab530d2dabd0204db0_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
02bbb76dd29920ab530d2dabd0204db0_JaffaCakes118
-
Size
209KB
-
MD5
02bbb76dd29920ab530d2dabd0204db0
-
SHA1
37f7a7b2b8e219ae0773ccaacd2c560497a78861
-
SHA256
e1d0e8f23cf44bbf4d174503f6dfd3b346818b615c13211a979e80f998a75cca
-
SHA512
bfcc9d830b5c83be3eae2aebed495b5c4cd66f09b4777eee7046aaf4065c5f629e4571330efb6ef44d2f0ecf4a8f5c84ac9814ab47749723ed8cb88e0e924483
-
SSDEEP
6144:WqnteTAFwB31oYDClIPGnf2f8K66a0pmJe:WqtULo6PGnufKJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 02bbb76dd29920ab530d2dabd0204db0_JaffaCakes118
Files
-
02bbb76dd29920ab530d2dabd0204db0_JaffaCakes118.exe windows:5 windows x86 arch:x86
4e8b414245905034d8c0ad864dbd148a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ReleaseSemaphore
InterlockedExchange
LCMapStringA
MapViewOfFile
LeaveCriticalSection
ResumeThread
GetThreadLocale
MulDiv
ExitProcess
TerminateProcess
lstrcpyW
CreateFileA
HeapReAlloc
GetVersionExA
GetPrivateProfileStringA
SetUnhandledExceptionFilter
LockResource
WritePrivateProfileStringA
VirtualAlloc
InterlockedDecrement
CopyFileA
GetSystemTimeAsFileTime
SetFilePointer
GetCurrentProcess
DeleteCriticalSection
FormatMessageW
EnumSystemLocalesA
GetTickCount
DeleteFileA
GetStringTypeW
HeapSize
OutputDebugStringA
GetCommandLineA
GetFileSize
GetLocaleInfoA
GetStdHandle
GetCPInfo
GetProcAddress
InterlockedCompareExchange
UnhandledExceptionFilter
msvcrt
_wcsnicmp
__dllonexit
_amsg_exit
_wcsicmp
malloc
wcschr
opengl32
glPushMatrix
shell32
SHGetMalloc
user32
EndDialog
BeginPaint
SetPropW
MapWindowPoints
SetWindowsHookExW
MessageBoxW
DrawTextW
IsWindow
GetMessageTime
GetMessageA
Sections
.text Size: 137KB - Virtual size: 137KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 65KB - Virtual size: 65KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 155KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ