Static task
static1
Behavioral task
behavioral1
Sample
0892f7223899ad5de76df1933286c299_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0892f7223899ad5de76df1933286c299_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
0892f7223899ad5de76df1933286c299_JaffaCakes118
-
Size
25KB
-
MD5
0892f7223899ad5de76df1933286c299
-
SHA1
4ec2422449a165c12131757d4b138a0824994627
-
SHA256
56622b2fffaf14b4876603cb4100d648ef1e659f256bead8ab0ef2036ed94baa
-
SHA512
dc80eaf0590c154ecc47333f848d9f6421128c438f01372cc7ecfa739de6f57bff30e64111b1bacaa545928ac7655c31d772c1f139af7e6260b13e83847bfce4
-
SSDEEP
384:uy3m5kNVZXha/HJveCAqnnzgbJWQZjlkr6aeNQ3wdRl3b8Zs2JO6CmL+m2/W2igK:eyNgpvVgNKrd36RlraOfmRgAQ9s
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0892f7223899ad5de76df1933286c299_JaffaCakes118
Files
-
0892f7223899ad5de76df1933286c299_JaffaCakes118.exe windows:4 windows x86 arch:x86
c803c7f35c27813c26451ac353edce50
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
PathQuoteSpacesW
PathFindFileNameW
StrToIntW
StrCmpW
PathAppendW
PathRemoveFileSpecW
dbghelp
MiniDumpWriteDump
MiniDumpReadDumpStream
gdi32
CreatePen
SetTextColor
SetBkMode
SelectObject
Polyline
GetObjectW
DeleteObject
CreateFontIndirectW
shell32
ExtractIconExW
CommandLineToArgvW
user32
DispatchMessageA
EnumDisplayDevicesW
PeekMessageA
SetClassLongW
CountClipboardFormats
kernel32
SetUnhandledExceptionFilter
TerminateProcess
UnhandledExceptionFilter
UnmapViewOfFile
lstrcpynW
SetEvent
SetLastError
QueryPerformanceCounter
MapViewOfFile
LocalFree
LoadLibraryW
LoadLibraryExA
LeaveCriticalSection
InitializeCriticalSection
GlobalFree
GetWindowsDirectoryW
CloseHandle
CreateFileMappingW
CreateFileW
CreateProcessW
CreateThread
DeleteCriticalSection
EnterCriticalSection
GetCommandLineW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetStartupInfoA
GetTempFileNameW
GetTempPathW
GetTickCount
imm32
ImmGetConversionListA
Sections
.text Size: 14KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 6KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ