Static task
static1
Behavioral task
behavioral1
Sample
0d184426229747b1ad3c49655e6da41c_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
0d184426229747b1ad3c49655e6da41c_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
0d184426229747b1ad3c49655e6da41c_JaffaCakes118
-
Size
903KB
-
MD5
0d184426229747b1ad3c49655e6da41c
-
SHA1
2b1db274ede6154ff683d65428090fdf86bd601f
-
SHA256
df58394b9701ff5a64f23b387d8159c4ef3f5c7f8787149561447c0ef405dea6
-
SHA512
2da79dd5a25586174834eb35028443eaffc1b33162e80bbf28e9ff8de8da1b16696a257f5d8af0df308a7bf6206119b6cb5b8553b6aedf3afdc0116ad148f021
-
SSDEEP
12288:sdXhlz3TxxCHyMAe4NgJDtLNfMIvrQBc1dkVicFwvSRjvk1fHNysYpay0pwFVXrC:sdBalNr/vMBcboEs81PM/NV6OI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0d184426229747b1ad3c49655e6da41c_JaffaCakes118
Files
-
0d184426229747b1ad3c49655e6da41c_JaffaCakes118.exe windows:4 windows x86 arch:x86
1a6be977062caa61a2add82af591089c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
Imports
advapi32
CryptDestroyHash
GetUserNameW
RegCloseKey
RegCreateKeyExA
RegEnumKeyExA
RegSetValueExA
kernel32
InitializeCriticalSection
shlwapi
PathCombineW
PathFileExistsW
PathMatchSpecW
PathRemoveFileSpecW
SHDeleteKeyA
StrStrW
wnsprintfA
wvnsprintfA
user32
EndDialog
FindWindowExA
GetDlgItemTextA
GetWindowTextA
GetWindowThreadProcessId
PeekMessageA
SetThreadDesktop
Sections
.cjmb Size: 43KB - Virtual size: 60KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.zqbif Size: 1024B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.lor Size: 5KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ