Static task
static1
Behavioral task
behavioral1
Sample
0c63fa7c3708067ebed41664c452993c_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0c63fa7c3708067ebed41664c452993c_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
0c63fa7c3708067ebed41664c452993c_JaffaCakes118
-
Size
1.3MB
-
MD5
0c63fa7c3708067ebed41664c452993c
-
SHA1
866559188cab1baf22270d62d357bc114c176c40
-
SHA256
0eb503192a5076a06e1848b6fc0dc9cb87e4db9f703274fce5e93397c11cba9b
-
SHA512
986b3f9d4cbe36e138a73155e4a938fe0bb5614ab32b3b74da5ec0c147219cbfb187556e437c357c842fa4c2626c1befe09ec8c9ffef30549ffdbae5ef114d17
-
SSDEEP
24576:z18XxvQZ4dYMktg2MmLuWcF+m7wUEq1v3xNMosgZdiCXLNFQpoX5:z1CvQOGMktem++wEgUFgb5FQpS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0c63fa7c3708067ebed41664c452993c_JaffaCakes118
Files
-
0c63fa7c3708067ebed41664c452993c_JaffaCakes118.exe windows:4 windows x86 arch:x86
caf83851bef005eb8055cbe74233631b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_AGGRESIVE_WS_TRIM
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_BYTES_REVERSED_HI
Imports
comctl32
ImageList_Draw
ImageList_Write
ImageList_DragShowNolock
ImageList_Add
ImageList_GetBkColor
kernel32
GetVersionExA
GlobalAlloc
VirtualAllocEx
VirtualAlloc
lstrlenA
RtlMoveMemory
GetOEMCP
LoadLibraryA
GetACP
gdi32
CopyEnhMetaFileA
GetPaletteEntries
GetDIBColorTable
CreateBrushIndirect
CreateCompatibleBitmap
BitBlt
SetBkMode
CreateDIBSection
GetCurrentPositionEx
SetPixel
shlwapi
PathIsDirectoryA
SHQueryInfoKeyA
PathIsContentTypeA
PathGetCharTypeA
version
VerQueryValueA
shell32
DragQueryFileA
SHGetFileInfoA
SHGetFolderPathA
SHFileOperationA
user32
GetForegroundWindow
advapi32
RegQueryValueExA
GetUserNameA
RegOpenKeyA
comdlg32
FindTextA
GetSaveFileNameA
GetFileTitleA
msvcrt
clock
rand
_acmdln
calloc
swprintf
wcstol
time
mbstowcs
sqrt
memcpy
tolower
wcsncmp
memmove
Sections
CODE Size: 56KB - Virtual size: 56KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 351KB - Virtual size: 352KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.edata Size: 467KB - Virtual size: 2.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
text Size: 357KB - Virtual size: 360KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DATA Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
BSS Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 82KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ