Static task
static1
Behavioral task
behavioral1
Sample
0a008226ea4a207dec956134d2c7b203_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0a008226ea4a207dec956134d2c7b203_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
0a008226ea4a207dec956134d2c7b203_JaffaCakes118
-
Size
222KB
-
MD5
0a008226ea4a207dec956134d2c7b203
-
SHA1
a7b239b80ea474f3ffa3953637de9742a28b9647
-
SHA256
d6d7e08d0307e34f4b8c6c483b9944a117e3739b271708a2cde324c73903ff69
-
SHA512
88fb8dca4cb981d4d4c7b614556bca4d674682e5a307a66da13ada608bc623f678aa5f4a9e28d78aa1523265f1a9e8df5f6d5e106824a844046c94aa50d54959
-
SSDEEP
3072:JYyNTNjS4yiu8srh8+fjSb9IfISNU38BrF/RF8O2/sIYUId7jLdxiS:5NjSBiuXrhB2bBOrFMLPqf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0a008226ea4a207dec956134d2c7b203_JaffaCakes118
Files
-
0a008226ea4a207dec956134d2c7b203_JaffaCakes118.exe windows:4 windows x86 arch:x86
972828501f28ef5c268ea9ac876ba04b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
comdlg32
ChooseColorW
PrintDlgA
ChooseFontW
PageSetupDlgW
FindTextA
GetFileTitleW
FindTextW
GetSaveFileNameW
PageSetupDlgA
LoadAlterBitmap
ChooseColorA
ChooseFontA
GetFileTitleA
PrintDlgW
GetOpenFileNameA
GetOpenFileNameW
GetSaveFileNameA
ReplaceTextW
shell32
SHAppBarMessage
SHBrowseForFolderW
FindExecutableW
SHGetDataFromIDListW
SHUpdateRecycleBinIcon
DragQueryFile
advapi32
ReportEventA
CryptReleaseContext
RegDeleteValueA
CryptGetDefaultProviderW
CryptExportKey
CryptAcquireContextA
RegReplaceKeyW
wininet
SetUrlCacheGroupAttributeW
ShowX509EncodedCertificate
FindNextUrlCacheContainerW
FtpRemoveDirectoryW
InternetGetCertByURL
FtpCreateDirectoryW
FreeUrlCacheSpaceA
DeleteUrlCacheContainerW
InternetInitializeAutoProxyDll
GopherCreateLocatorA
DetectAutoProxyUrl
InternetDialA
SetUrlCacheConfigInfoW
CreateUrlCacheEntryA
UnlockUrlCacheEntryFile
UrlZonesDetach
HttpOpenRequestW
IncrementUrlCacheHeaderData
HttpSendRequestW
HttpQueryInfoW
InternetGoOnline
InternetGoOnlineW
FtpRenameFileA
SetUrlCacheEntryInfoW
GopherOpenFileA
kernel32
GetStartupInfoW
IsValidCodePage
CompareStringW
GetSystemTimeAsFileTime
GetModuleFileNameA
TlsFree
GetOEMCP
Sleep
ExitProcess
WriteFile
GetStringTypeW
TlsGetValue
GetLocaleInfoW
GetProcAddress
GetCurrentThread
SetLastError
LoadLibraryA
VirtualQuery
HeapDestroy
LCMapStringA
RtlUnwind
IsDebuggerPresent
HeapReAlloc
VirtualAlloc
GetEnvironmentStringsW
MultiByteToWideChar
GetStdHandle
HeapSize
GetCurrentThreadId
GetStringTypeA
DeleteCriticalSection
GetStartupInfoA
GetUserDefaultLCID
VirtualFree
GetVersionExA
GetCPInfo
InitializeCriticalSection
FreeEnvironmentStringsA
IsValidLocale
GetProcessHeap
UnhandledExceptionFilter
SetEnvironmentVariableA
TlsSetValue
GetTimeFormatA
GetCurrentProcessId
InterlockedExchange
GetTickCount
GetModuleFileNameW
GetDateFormatA
HeapCreate
FreeLibrary
EnumSystemLocalesA
InterlockedDecrement
HeapAlloc
GetCommandLineW
LCMapStringW
InterlockedIncrement
WideCharToMultiByte
GetModuleHandleA
LeaveCriticalSection
FormatMessageW
GetCommandLineA
HeapFree
GetTimeZoneInformation
GetCurrentProcess
GetACP
QueryPerformanceCounter
SetConsoleCtrlHandler
FreeEnvironmentStringsW
CompareStringA
GetLocaleInfoA
SetUnhandledExceptionFilter
TerminateProcess
TlsAlloc
GetEnvironmentStrings
GetLastError
EnterCriticalSection
SetHandleCount
GetFileType
user32
CallNextHookEx
DispatchMessageW
SendDlgItemMessageW
MonitorFromPoint
CopyImage
GetDialogBaseUnits
EnumDisplaySettingsExA
OpenWindowStationA
DdeConnectList
GetFocus
InternalGetWindowText
EnableMenuItem
GetWindowTextA
SetMessageExtraInfo
DdeInitializeA
MapWindowPoints
RegisterClassA
SetDlgItemTextW
GetWindowWord
Sections
.text Size: 105KB - Virtual size: 104KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 111KB - Virtual size: 142KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ