Static task
static1
Behavioral task
behavioral1
Sample
02aa988865fe0f20ba8683c14637d6cc_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
02aa988865fe0f20ba8683c14637d6cc_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
02aa988865fe0f20ba8683c14637d6cc_JaffaCakes118
-
Size
408KB
-
MD5
02aa988865fe0f20ba8683c14637d6cc
-
SHA1
0df7ead1cee344eb88ca1d1c487fa2217a7e88c7
-
SHA256
0db586b536dc0c50bd5ea752975409e40fae6845513c696df9a4d02b010c5fa5
-
SHA512
940e9d339a687ecec6cef5e1473cdbf18c40815b9902923afd879a4267289fa4ce58c6275ef5d0c87934488fddc39c583851db41223a8aa3764d782bff7dd1fe
-
SSDEEP
12288:WQ7WC6tojmjklkghxTmLWYAtrImSftdQMm:RX6toQJvfXQt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 02aa988865fe0f20ba8683c14637d6cc_JaffaCakes118
Files
-
02aa988865fe0f20ba8683c14637d6cc_JaffaCakes118.exe windows:49819 windows x86 arch:x86
2d6c7b34d2d79c6bea71eede2b7ab6e2
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
MultiByteToWideChar
GetCommandLineA
GetTickCount
ExitProcess
LoadLibraryExW
HeapFree
VirtualAlloc
advapi32
GetTokenInformation
InitializeAcl
AllocateAndInitializeSid
RegQueryInfoKeyW
RegOpenKeyW
RegEnumKeyExW
InitializeAcl
InitializeAcl
OpenThreadToken
RegEnumValueW
gdi32
StretchBlt
SetTextColor
DeleteObject
LineTo
CreateSolidBrush
PatBlt
DeleteDC
CreateSolidBrush
MoveToEx
GetTextExtentPoint32W
shell32
ShellExecuteExW
Shell_NotifyIconW
ExtractIconExW
DragAcceptFiles
DragQueryFileW
user32
OffsetRect
PostQuitMessage
EndDialog
GetSysColor
GetParent
GetSystemMetrics
GetSubMenu
Sections
.text Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 388KB - Virtual size: 964KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ