Static task
static1
Behavioral task
behavioral1
Sample
14d0d855ae10705f20331e42d2756f48_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
14d0d855ae10705f20331e42d2756f48_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
14d0d855ae10705f20331e42d2756f48_JaffaCakes118
-
Size
165KB
-
MD5
14d0d855ae10705f20331e42d2756f48
-
SHA1
e525797089cd5ba21f861476426ea6a237cef428
-
SHA256
b72c7f892bc853393582b18bfcec54d7526b67f31170fc2b0ead0e9d8d9235c4
-
SHA512
25b7ec6a291a0bb34e7561480e88ea2e4af218ee193292f284c7a8d66bc9f212a5eeba8b8ce4bdef89cbf569406fefa14d76832536e86fa06d90466aaa2b02ec
-
SSDEEP
3072:wjZvft5E+VdxXt+8bv6OCQ7bqI9ZfdrYFAb86CmdNOnrC5AJymVJyOzHphj/EVEZ:wFft5EMx9IO/+IjfdrmAb8R+mJymmqpx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 14d0d855ae10705f20331e42d2756f48_JaffaCakes118
Files
-
14d0d855ae10705f20331e42d2756f48_JaffaCakes118.exe windows:4 windows x86 arch:x86
1bb65a4148a1b271a0469a567f48cb06
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_DEBUG_STRIPPED
Imports
user32
RealGetWindowClassA
ReleaseCapture
ValidateRect
InvalidateRgn
UpdateWindow
IsWindowEnabled
ExcludeUpdateRgn
IsWindow
SetCapture
EnableWindow
FlashWindow
DestroyWindow
ValidateRgn
GetCapture
GetUpdateRgn
mprapi
MprConfigServerConnect
MprConfigServerDisconnect
MprConfigGetFriendlyName
kernel32
LoadResource
CompareStringA
ConvertFiberToThread
FindNextFileW
FreeLibrary
LocalFileTimeToFileTime
SetErrorMode
GetCurrentProcess
FindResourceW
SetThreadIdealProcessor
GetStringTypeW
LocalFree
FileTimeToSystemTime
SetCurrentDirectoryW
LCMapStringW
EnumResourceNamesW
FindClose
IsBadReadPtr
LocalAlloc
RegisterWaitForSingleObject
FindFirstFileW
FileTimeToLocalFileTime
GetShortPathNameW
GetSystemDirectoryW
SetEnvironmentVariableW
GetOEMCP
GetLocalTime
SystemTimeToFileTime
SearchPathW
Sections
.text Size: 98KB - Virtual size: 98KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 63KB - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imul Size: 1024B - Virtual size: 380KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ