Static task
static1
Behavioral task
behavioral1
Sample
04e528be5e82d3501dbec336339f9007_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
04e528be5e82d3501dbec336339f9007_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
04e528be5e82d3501dbec336339f9007_JaffaCakes118
-
Size
181KB
-
MD5
04e528be5e82d3501dbec336339f9007
-
SHA1
0ea95f65bb62fee647823c27643ad0016d6343e9
-
SHA256
d8082f217147d6e70df35b2d8ff3ae6427fa6362bbb3c90c52bad5b3ac5994ba
-
SHA512
1e8b4cf3ada5457130d5f0490d4a2f5f8dde01e337a6f147d0f531ae406dca0cc6c046911543406880e7a7cfd4fcfed3445a8b5019c8db184ddafb3123ffc622
-
SSDEEP
3072:VLs0AArOg5qd1Fh5l5lIbR6LNNfGtdm7ycKsfq+oHccyzP776p/T:VLXAArOsSzxEKNsP3Mo8iT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 04e528be5e82d3501dbec336339f9007_JaffaCakes118
Files
-
04e528be5e82d3501dbec336339f9007_JaffaCakes118.exe windows:4 windows x86 arch:x86
e3963563f28cd5cb39403872cd82ecb7
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
SHQueryValueExA
SHRegWriteUSValueW
StrRetToStrA
PathStripPathA
StrFormatKBSizeW
StrTrimW
ord8
shell32
SHGetIconOverlayIndexW
ord149
DragAcceptFiles
ord47
gdi32
GetSystemPaletteUse
MoveToEx
GetPixel
PolyTextOutA
comctl32
ord13
PropertySheetW
InitMUILanguage
kernel32
CreateDirectoryW
GetFileSize
SetHandleCount
VirtualAllocEx
GetDateFormatW
GetBinaryTypeA
GetPriorityClass
GetModuleHandleA
GetProcAddress
LoadLibraryA
OpenMutexW
HeapReAlloc
GetOverlappedResult
RtlCaptureContext
OpenFile
CreateNamedPipeW
OpenEventW
LeaveCriticalSection
FreeLibraryAndExitThread
lstrcmpA
QueryDosDeviceW
InterlockedCompareExchange
FindFirstVolumeA
EnterCriticalSection
GetStartupInfoA
user32
SetRect
GetParent
GetDlgItem
HideCaret
GetMessageA
SendMessageTimeoutW
RegisterClipboardFormatW
SetMessageQueue
DrawIcon
GetTitleBarInfo
ScrollDC
GetUpdateRect
ToAscii
AnimateWindow
msvcrt
isdigit
ldiv
getwc
ferror
fflush
qsort
wcscpy
isgraph
iswascii
strcpy
iswcntrl
_c_exit
_exit
_XcptFilter
_cexit
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
malloc
_sleep
memcpy
memset
memmove
wcscmp
Sections
.text Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 151KB - Virtual size: 200KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE