?_ScreenToClient@@YGPAXPAKPAEPAI@Z
Static task
static1
Behavioral task
behavioral1
Sample
15a1fb9e471fe3daee3a016a905fd46e_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
15a1fb9e471fe3daee3a016a905fd46e_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
15a1fb9e471fe3daee3a016a905fd46e_JaffaCakes118
-
Size
22KB
-
MD5
15a1fb9e471fe3daee3a016a905fd46e
-
SHA1
0f9c3c145daedcfe0256603957eb04ded4e1f76d
-
SHA256
8bc5090f13ead5a54aa221ed3fea9704639ba0e8f0b7133adc7a849a8966b90e
-
SHA512
46c856c47b4e246af746ed136fc8d0c750f4f4b91c0ef1fdca1d70811cfbf20b1083b3b0cb3d821b37ebea7c3eba02b7545ba3f34fd08749f28d2d2bec577128
-
SSDEEP
384:BzRnYZHUzpS2meVk6HgNgkzi6gCpDP7mAs9Jq:yoYDe0NgkO6ggDPfMM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 15a1fb9e471fe3daee3a016a905fd46e_JaffaCakes118
Files
-
15a1fb9e471fe3daee3a016a905fd46e_JaffaCakes118.exe windows:5 windows x86 arch:x86
42e02aa48a41979e737be88e1d8e5251
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
StrCmpNIW
PathCompactPathW
StrRStrIW
StrCpyNW
StrTrimA
ord158
PathFindNextComponentW
ChrCmpIW
kernel32
MoveFileExW
GetModuleFileNameW
GetTapeParameters
FileTimeToDosDateTime
SetupComm
GetCommModemStatus
LoadLibraryExW
GlobalCompact
LoadLibraryW
SetMessageWaitingIndicator
SetTapePosition
LoadLibraryA
CreateSemaphoreW
lstrcmpW
GetMailslotInfo
GetModuleHandleW
SetWaitableTimer
SetInformationJobObject
user32
UnregisterClassW
LoadImageW
ScreenToClient
GetSystemMenu
CloseClipboard
InvertRect
GetWindowTextLengthW
GetPropA
GetMouseMovePointsEx
WaitForInputIdle
GetMenuStringW
EnumDesktopsW
GetWindowTextA
SetWinEventHook
GetMenuContextHelpId
PostMessageA
MapWindowPoints
GetDlgCtrlID
ValidateRect
CheckMenuItem
LoadCursorFromFileW
SystemParametersInfoA
gdi32
PlayEnhMetaFile
GetEnhMetaFileW
SelectClipPath
GetRandomRgn
GetFontData
PolylineTo
CreateFontIndirectA
GetDeviceCaps
CreateEnhMetaFileA
CreatePolyPolygonRgn
GetTextExtentExPointW
SelectPalette
advapi32
AreAnyAccessesGranted
msvcrt
memset
Exports
Exports
Sections
.text Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.icode Size: 1024B - Virtual size: 643B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 644B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.m_data Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.c_data Size: 512B - Virtual size: 60B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.n_data Size: 1024B - Virtual size: 752B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 130KB - Virtual size: 129KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 882B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ