Static task
static1
Behavioral task
behavioral1
Sample
0f1d529a5c81dfd0b60fa8de22f4aca6_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0f1d529a5c81dfd0b60fa8de22f4aca6_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
0f1d529a5c81dfd0b60fa8de22f4aca6_JaffaCakes118
-
Size
221KB
-
MD5
0f1d529a5c81dfd0b60fa8de22f4aca6
-
SHA1
1bdb3527f9a0cc9723cd0be9eb1ef00b4c18da37
-
SHA256
dfc728aaff4894ffcdfcf651061b50e656f0e5f2937746216dafb53af46ced92
-
SHA512
a18223e2597d454b742936f290aaecead888158f96f2283577e0e9c08a8289018ad9d53d2a1cda05b2841659487a1c2ffbc372b172b6aed0d9b61180d1c8b846
-
SSDEEP
3072:LmdWzVNbAPBtYh25dAUlbyj856nv35P+6QHGKljvBht0lc5Dlei25iCDk:Cd8buirf5I1vGlcYAOk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0f1d529a5c81dfd0b60fa8de22f4aca6_JaffaCakes118
Files
-
0f1d529a5c81dfd0b60fa8de22f4aca6_JaffaCakes118.exe windows:4 windows x86 arch:x86
b9790fea6577164fa9e7af3b53a30e24
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
version
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
imagehlp
ImageNtHeader
kernel32
LoadResource
FindResourceW
LoadLibraryExW
CloseHandle
UnmapViewOfFile
GetFileSize
MapViewOfFile
CreateFileMappingW
GetFileInformationByHandle
CreateFileW
ReadFile
FindClose
FindNextFileW
FindFirstFileW
GetFileAttributesW
LockResource
FormatMessageW
GetCurrentDirectoryW
GetLastError
GetFullPathNameW
MultiByteToWideChar
CreateFileA
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SizeofResource
FreeResource
FreeLibrary
FileTimeToLocalFileTime
FileTimeToSystemTime
GetTimeFormatW
GetDateFormatW
GetCurrentProcess
GetProcAddress
LocalAlloc
LoadLibraryW
LocalFree
GetModuleHandleW
GetLocaleInfoA
HeapSize
InterlockedDecrement
LeaveCriticalSection
SetStdHandle
HeapAlloc
HeapFree
RtlUnwind
GetVersionExA
GetProcessHeap
DeleteCriticalSection
EnterCriticalSection
VirtualFree
VirtualAlloc
HeapReAlloc
HeapDestroy
HeapCreate
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
RaiseException
SetHandleCount
GetFileType
GetStartupInfoA
LCMapStringA
WideCharToMultiByte
LCMapStringW
GetModuleFileNameW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeCriticalSection
Sleep
LoadLibraryA
SetFilePointer
GetConsoleCP
GetConsoleMode
GetStringTypeA
GetStringTypeW
user32
DialogBoxIndirectParamW
GetDlgItem
GetSysColorBrush
EndDialog
SetWindowTextW
LoadCursorW
SetCursor
InflateRect
SendMessageW
gdi32
SetMapMode
StartDocW
StartPage
EndPage
EndDoc
GetDeviceCaps
comdlg32
PrintDlgW
advapi32
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
RegCreateKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
CryptAcquireContextW
oleaut32
SysAllocString
SysFreeString
Sections
.text Size: 76KB - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 28KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 96KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ