Static task
static1
Behavioral task
behavioral1
Sample
1572a6caba7d1ca0f303d8fd5c9ff078_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
1572a6caba7d1ca0f303d8fd5c9ff078_JaffaCakes118.exe
Resource
win10v2004-20240910-en
General
-
Target
1572a6caba7d1ca0f303d8fd5c9ff078_JaffaCakes118
-
Size
581KB
-
MD5
1572a6caba7d1ca0f303d8fd5c9ff078
-
SHA1
7d61967f28f850f9757f1c726f3217ef4fd764cf
-
SHA256
856b54dfbd8b540d6b84c8df6cb216a3578e7d4897ae4596706f593a886de328
-
SHA512
997f22bc0d89cdb81e190054eac7b7e79a7819f21e1a7217b3e7d1d379df3bbff6a81c6b52c666be927ed90bfc1adde096ef5c93958521dd10dd9b3ee65dc64d
-
SSDEEP
12288:x2dcc3zvSUGljdYqvUkKr06SaGLB88B0oOR4xci:IN6UivvUkKA6SfLBPB0oOid
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1572a6caba7d1ca0f303d8fd5c9ff078_JaffaCakes118
Files
-
1572a6caba7d1ca0f303d8fd5c9ff078_JaffaCakes118.exe windows:4 windows x86 arch:x86
8052a795d31527bae2a12ca9d9683bd4
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
IsValidLocale
VirtualAlloc
LoadLibraryA
GetHandleInformation
CreateWaitableTimerA
GetProcAddress
GetLocalTime
GetFileType
PrepareTape
SwitchToFiber
EscapeCommFunction
GetModuleHandleA
GetVersion
GetNumberFormatA
GetConsoleMode
FreeLibrary
GetSystemTime
GetStartupInfoA
opengl32
glLightiv
glRasterPos4d
wglUseFontOutlinesA
glIndexd
glColor4us
glColor3f
wglDeleteContext
glTranslatef
glVertex2d
glVertex3fv
glGetLightiv
wglCreateContext
wglMakeCurrent
glEnableClientState
wglDescribePixelFormat
glTexParameterf
glVertex3dv
glColor4uiv
glGetTexLevelParameterfv
glRecti
glCopyPixels
glTexEnvi
glMap1d
glIndexub
glGetFloatv
glFeedbackBuffer
wglGetCurrentDC
shell32
StrRChrIW
StrRChrW
StrRStrIA
shlwapi
PathCompactPathA
PathSkipRootW
UrlGetLocationW
SHRegWriteUSValueA
StrTrimA
PathIsFileSpecA
SHRegQueryUSValueA
SHOpenRegStreamA
PathIsUNCServerW
SHSetValueA
PathAddBackslashA
PathIsSameRootW
IntlStrEqWorkerA
StrCmpIW
msvcrt
_onexit
_getdllprocaddr
fwrite
_unlink
ferror
fclose
fprintf
memset
ftell
fwprintf
feof
printf
fseek
sprintf
fputs
fopen
fsetpos
fputc
remove
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__dllonexit
_controlfp
_except_handler3
fread
__set_app_type
__p__fmode
__p__commode
Sections
.text Size: 40KB - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 532KB - Virtual size: 530KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE