Static task
static1
Behavioral task
behavioral1
Sample
12d04d47304006e478e9e89c1087062c_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
12d04d47304006e478e9e89c1087062c_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
12d04d47304006e478e9e89c1087062c_JaffaCakes118
-
Size
447KB
-
MD5
12d04d47304006e478e9e89c1087062c
-
SHA1
071d58e7f8e7da15113007c5114d6548f6b9309b
-
SHA256
c5809ab93e48ec6daf175c48d44ae60e4efec0293ae518da4d5604da1e6488b3
-
SHA512
b505af9e4fc851e815e23344468716911f2722ae580a82d5a3e7dda39a8962c41e85e72dc0afba8237df0539e9b0a1a54a851f4a4c76e7471a0974c59ffbbd85
-
SSDEEP
6144:ZQf1Ob6qorBSiURRF0Bj5NE1Y5cIcwJHM06hu/hzVGmgsCVv8ub4iSfbjDF0:HwGRRcFN6YGI5JHM0+uZVGmev8D75
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 12d04d47304006e478e9e89c1087062c_JaffaCakes118
Files
-
12d04d47304006e478e9e89c1087062c_JaffaCakes118.exe windows:4 windows x86 arch:x86
44a3344080070fb7102fb852407ad259
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
ChangeDisplaySettingsW
DrawStateW
GetKeyState
GetPropW
SendMessageTimeoutA
LoadImageW
ShowCaret
CheckMenuRadioItem
SetClipboardData
gdi32
StartDocW
InvertRgn
SetWinMetaFileBits
CloseMetaFile
SelectClipPath
GetKerningPairs
GetBkColor
GetLogColorSpaceW
SetMiterLimit
advapi32
InitiateSystemShutdownW
LookupPrivilegeValueW
RegSaveKeyA
AbortSystemShutdownW
RegCloseKey
RegOpenKeyA
AbortSystemShutdownA
RegQueryMultipleValuesW
CryptCreateHash
LookupPrivilegeValueA
CryptAcquireContextW
RegEnumValueA
LookupSecurityDescriptorPartsA
CryptSignHashA
LookupAccountNameW
wininet
InternetGetCertByURLA
GopherFindFirstFileW
RunOnceUrlCache
IsUrlCacheEntryExpiredW
FindFirstUrlCacheContainerA
CreateUrlCacheEntryA
GopherFindFirstFileA
FtpFindFirstFileW
FtpGetCurrentDirectoryA
GetUrlCacheGroupAttributeW
FindNextUrlCacheEntryExW
FindNextUrlCacheContainerA
InternetGetLastResponseInfoA
HttpSendRequestA
InternetSetOptionExA
CommitUrlCacheEntryA
InternetCheckConnectionW
InternetWriteFileExW
FtpCommandW
kernel32
CompareStringA
LocalUnlock
HeapSize
VirtualAlloc
GetCommandLineA
InterlockedExchange
InterlockedDecrement
GetModuleFileNameA
GetCurrentThreadId
GetSystemDirectoryA
GetCalendarInfoA
GetACP
GetProcAddress
HeapDestroy
LCMapStringW
LoadLibraryExA
LCMapStringA
SetLastError
GetLocaleInfoA
IsValidCodePage
FreeLibrary
TlsAlloc
HeapAlloc
WaitForSingleObject
VirtualAllocEx
FreeEnvironmentStringsW
GetProcessHeap
IsValidLocale
MultiByteToWideChar
LeaveCriticalSection
GetFileType
EnumCalendarInfoA
GetWindowsDirectoryA
GetStdHandle
HeapReAlloc
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetEnvironmentStrings
lstrcmpi
TlsFree
SetUnhandledExceptionFilter
GetOEMCP
lstrcatW
IsDebuggerPresent
GetSystemTimeAsFileTime
UnlockFile
GetLastError
HeapFree
GetTickCount
SetConsoleCursorInfo
FindFirstFileExA
lstrcpyn
CompareStringW
TlsSetValue
ExitProcess
WriteFile
GetLocaleInfoW
InitializeCriticalSection
GetUserDefaultLangID
GetVersionExA
QueryPerformanceCounter
GetUserDefaultLCID
GetStartupInfoA
WideCharToMultiByte
WaitNamedPipeA
GetStringTypeW
LoadLibraryA
InterlockedIncrement
GetModuleHandleA
Sleep
RtlUnwind
SetHandleCount
GetCPInfo
TlsGetValue
GetEnvironmentStringsW
EnumSystemLocalesA
GetCurrentProcess
SetConsoleCtrlHandler
HeapCreate
DeleteCriticalSection
GetCompressedFileSizeW
GetTimeFormatA
GlobalFindAtomW
GetTimeZoneInformation
EnterCriticalSection
VirtualFree
GetDateFormatA
GetStringTypeA
GetVolumeInformationW
GetCurrentThread
GetCurrentProcessId
VirtualQuery
SetEnvironmentVariableA
TerminateProcess
LocalShrink
comdlg32
ReplaceTextW
ChooseFontA
LoadAlterBitmap
Sections
.text Size: 127KB - Virtual size: 127KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 311KB - Virtual size: 311KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ