Static task
static1
Behavioral task
behavioral1
Sample
25fac4b8a41d9517f7846bbbac29ace9_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
25fac4b8a41d9517f7846bbbac29ace9_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
25fac4b8a41d9517f7846bbbac29ace9_JaffaCakes118
-
Size
165KB
-
MD5
25fac4b8a41d9517f7846bbbac29ace9
-
SHA1
ae05fa721915a4ab75ec57e063413ae8bcc8265b
-
SHA256
687dd8b84b72ce1ef018552e2c2a7193c16d4bbaf9f70fe3c679c1bb0dc171e8
-
SHA512
2b8c0f932136318ec66ab485537c7bf98d34a969ed3528a1070a9538b712ae425dd3d72c71eb468fe362d16f5ab53500412464a6e931ab1974017858538b8ce6
-
SSDEEP
3072:wjZvft5E+VdxXt+8bv6OCQ7bqI9ZfdrYFAb86CmdNOnrC5AJymVJyOzHphj/EVEZ:wFft5EMx9IO/+IjfdrmAb8R+mJymmqpx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 25fac4b8a41d9517f7846bbbac29ace9_JaffaCakes118
Files
-
25fac4b8a41d9517f7846bbbac29ace9_JaffaCakes118.exe windows:4 windows x86 arch:x86
1bb65a4148a1b271a0469a567f48cb06
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_DEBUG_STRIPPED
Imports
user32
RealGetWindowClassA
ReleaseCapture
ValidateRect
InvalidateRgn
UpdateWindow
IsWindowEnabled
ExcludeUpdateRgn
IsWindow
SetCapture
EnableWindow
FlashWindow
DestroyWindow
ValidateRgn
GetCapture
GetUpdateRgn
mprapi
MprConfigServerConnect
MprConfigServerDisconnect
MprConfigGetFriendlyName
kernel32
LoadResource
CompareStringA
ConvertFiberToThread
FindNextFileW
FreeLibrary
LocalFileTimeToFileTime
SetErrorMode
GetCurrentProcess
FindResourceW
SetThreadIdealProcessor
GetStringTypeW
LocalFree
FileTimeToSystemTime
SetCurrentDirectoryW
LCMapStringW
EnumResourceNamesW
FindClose
IsBadReadPtr
LocalAlloc
RegisterWaitForSingleObject
FindFirstFileW
FileTimeToLocalFileTime
GetShortPathNameW
GetSystemDirectoryW
SetEnvironmentVariableW
GetOEMCP
GetLocalTime
SystemTimeToFileTime
SearchPathW
Sections
.text Size: 98KB - Virtual size: 98KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 63KB - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imul Size: 1024B - Virtual size: 380KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ