Static task
static1
Behavioral task
behavioral1
Sample
0a8ed2c01c0065bf948f7b6106827a72_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0a8ed2c01c0065bf948f7b6106827a72_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
0a8ed2c01c0065bf948f7b6106827a72_JaffaCakes118
-
Size
230KB
-
MD5
0a8ed2c01c0065bf948f7b6106827a72
-
SHA1
d9a2eac82f3a5badff070d564355d25aab13d1e8
-
SHA256
623aff6343409a112180630feec8f0a60fd34942ae79f24a0a5b1b4b6993ffaf
-
SHA512
092d8542a9112aaa930ac105c76e21bb7a7fe2007b29aacd19d06051d47ade0bc6536ca40a8129a9d0d22903fcc9c738f0f2b1495c6718a8d633c56b0e385ecf
-
SSDEEP
6144:Og93cbNYr3V07aYlUHbkabIQ2yhG9EMk22kNXjTJJJQukif2:Og93chYRQaYlQbpR2CNcjLkif
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0a8ed2c01c0065bf948f7b6106827a72_JaffaCakes118
Files
-
0a8ed2c01c0065bf948f7b6106827a72_JaffaCakes118.exe windows:4 windows x86 arch:x86
60c3c43942b840526dc164dd49250c0c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
wininet
FindFirstUrlCacheContainerA
FindNextUrlCacheEntryExW
SetUrlCacheEntryInfoW
DetectAutoProxyUrl
GetUrlCacheEntryInfoA
InternetSetFilePointer
shell32
RealShellExecuteA
CheckEscapesW
user32
TranslateAccelerator
DrawTextExW
InsertMenuItemW
GetWindowRect
GetWindowContextHelpId
GetMenuInfo
SetUserObjectInformationA
IsDialogMessageW
OemKeyScan
CreateIcon
FindWindowExA
CharLowerA
LoadAcceleratorsA
CallMsgFilterW
GetMenuItemRect
FindWindowA
MapDialogRect
SetWindowPos
ToAscii
RegisterClassA
CopyImage
MessageBeep
GetProcessWindowStation
VkKeyScanExW
ChangeDisplaySettingsExW
advapi32
CryptHashData
RegEnumValueW
CryptExportKey
RegCreateKeyExW
CryptContextAddRef
RegCreateKeyA
CryptImportKey
RegEnumKeyExW
RegSetValueW
RegConnectRegistryW
LogonUserA
RegNotifyChangeKeyValue
RegReplaceKeyW
CryptReleaseContext
RegDeleteKeyA
RegLoadKeyW
kernel32
CompareStringW
GetLastError
RtlUnwind
GetCurrentThread
InterlockedExchange
VirtualFree
FileTimeToDosDateTime
GetCurrentProcess
IsValidLocale
LoadLibraryA
InterlockedDecrement
GetProcAddress
LCMapStringW
EnumDateFormatsA
HeapCreate
DeleteCriticalSection
GetStringTypeExA
SetEnvironmentVariableA
GetStringTypeA
TlsSetValue
GetStdHandle
SetLastError
GetStartupInfoW
GetEnvironmentStrings
GetModuleFileNameA
SetUnhandledExceptionFilter
HeapDestroy
GetStartupInfoA
FreeEnvironmentStringsA
HeapSize
GetEnvironmentVariableA
SetEvent
FreeEnvironmentStringsW
GetCPInfo
LCMapStringA
EnumSystemLocalesA
HeapReAlloc
VirtualQuery
WaitForSingleObjectEx
FreeLibrary
MultiByteToWideChar
EnterCriticalSection
TerminateProcess
GetStringTypeW
GetOEMCP
HeapAlloc
GetCurrencyFormatA
GetCommandLineW
GetEnvironmentStringsW
GlobalAddAtomW
GetLocaleInfoA
GetTimeFormatA
TlsAlloc
InitializeCriticalSection
GetFileType
LeaveCriticalSection
QueryPerformanceCounter
GetVersionExA
GetLocaleInfoW
GetTimeZoneInformation
GetProcessHeap
GetCommandLineA
GetCurrentThreadId
UnhandledExceptionFilter
GetSystemTimeAsFileTime
IsValidCodePage
SetConsoleCtrlHandler
TlsGetValue
InterlockedIncrement
TlsFree
GetDateFormatA
CompareStringA
GetTickCount
WideCharToMultiByte
VirtualAlloc
GetACP
WriteFile
GetModuleFileNameW
GetCurrentProcessId
GetUserDefaultLCID
SetHandleCount
ExitProcess
Sleep
GetModuleHandleA
IsDebuggerPresent
HeapFree
comdlg32
GetOpenFileNameA
FindTextW
ChooseColorW
PageSetupDlgW
FindTextA
GetSaveFileNameA
ChooseColorA
GetFileTitleW
ReplaceTextW
Sections
.text Size: 113KB - Virtual size: 112KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 112KB - Virtual size: 138KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ