Static task
static1
Behavioral task
behavioral1
Sample
16681eb14b3efb1b6b4d7176f0c93110_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
16681eb14b3efb1b6b4d7176f0c93110_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
16681eb14b3efb1b6b4d7176f0c93110_JaffaCakes118
-
Size
128KB
-
MD5
16681eb14b3efb1b6b4d7176f0c93110
-
SHA1
9fe293325275d7cfd43f53cb9ec3c79530846d1a
-
SHA256
643554a23e3a554606c45778965c01ea1cc95c5b18c5f8e52d4679dd2f14e6f2
-
SHA512
1853f628ceac85e7fd5bbb23e36fff7d1750e67784fb0bacb872a5ddc6a0ea688fe82bf6dd524a8cade5126caf9c05eda208534229195fab9f7b0a06e2387707
-
SSDEEP
3072:N3tNIQOsJrKnQiRuLJ2S8jVmfWhIXNX+6lLRjYD:JvIQVxixRkQjvIXNXrG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 16681eb14b3efb1b6b4d7176f0c93110_JaffaCakes118
Files
-
16681eb14b3efb1b6b4d7176f0c93110_JaffaCakes118.exe windows:4 windows x86 arch:x86
ed090d4fb92c158feba6eac514dac455
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcAddress
GetLocalTime
GetLastError
GlobalFree
CreateThread
InterlockedDecrement
lstrcmpiW
GlobalLock
WriteFile
HeapFree
GetLocaleInfoA
GetModuleHandleA
GetOEMCP
GlobalUnlock
FormatMessageA
GetVersionExA
EndUpdateResourceW
TerminateProcess
LoadLibraryA
FreeEnvironmentStringsW
ExitProcess
msvcrt
_vsnprintf
atol
__getmainargs
swprintf
strchr
_wtol
memset
wcslen
_wcsicmp
wcscmp
memcpy
wcscat
__set_app_type
isdigit
iscntrl
_acmdln
isleadbyte
free
__dllonexit
_adjust_fdiv
wcstol
wcstok
mblen
iswascii
fclose
user32
FindWindowW
FrameRect
CharUpperW
SystemParametersInfoA
AppendMenuW
DrawTextW
IsDlgButtonChecked
PeekMessageW
SetWindowTextW
DefWindowProcW
SetScrollPos
MessageBeep
DrawEdge
RedrawWindow
GetWindowLongA
LoadMenuA
GetMessageA
DrawIconEx
EndDialog
GetMenu
CopyRect
OemKeyScan
IsWindowVisible
RegisterShellHookWindow
gdi32
CreateSolidBrush
MoveToEx
CreatePalette
Rectangle
SetBkColor
CreateFontIndirectW
LineTo
ExtTextOutW
PatBlt
TranslateCharsetInfo
GetTextExtentPointW
StretchBlt
CreateCompatibleDC
DeleteObject
GetTextExtentPoint32W
GetTextMetricsW
tapi32
lineDrop
lineSetAgentStateEx
lineCreateAgentSessionW
phoneGetButtonInfo
lineGetAddressCaps
phoneGetMessage
lineConfigDialogEdit
lineGetDevConfigW
shell32
SHGetMalloc
SHGetPathFromIDListW
SHGetSpecialFolderLocation
ShellExecuteW
ShellAboutW
SHGetFolderPathW
Sections
.text Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
nes1 Size: 512B - Virtual size: 278B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
nes2 Size: 512B - Virtual size: 360B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
nes3 Size: 512B - Virtual size: 401B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
nes4 Size: 512B - Virtual size: 306B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 112KB - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 60B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ