Static task
static1
Behavioral task
behavioral1
Sample
28b196abdcd957a839e2cd60176a5d9e_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
28b196abdcd957a839e2cd60176a5d9e_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
28b196abdcd957a839e2cd60176a5d9e_JaffaCakes118
-
Size
18KB
-
MD5
28b196abdcd957a839e2cd60176a5d9e
-
SHA1
ba24c9e45c105b6925e974ede6469b6e277824ca
-
SHA256
6a024ad8208eb24052659a035cd2cf2e4ac5ee10d61fdfdb4018d08ff64f5005
-
SHA512
1b99f9d0dd58461a1c49344545d6ef516e83d85a6532ceb6a802a4eb5f6127c576f992babc21e47a3315d2dae8f4fe7178ca4e4370e4aecdb54a99d7ab3e4c03
-
SSDEEP
192:zi0Mg3G9712v4A06FXmuKnMrelWZWDUlzBBYzHlVo00WWwSs8MB6Z:zZF3Gd12QA06F8nueljGYz00w6B
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 28b196abdcd957a839e2cd60176a5d9e_JaffaCakes118
Files
-
28b196abdcd957a839e2cd60176a5d9e_JaffaCakes118.exe windows:4 windows x86 arch:x86
925a1f53c09e20b6651550938baf544a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrcmpiW
GetProcAddress
SetLastError
HeapFree
GetCurrentProcessId
GetModuleFileNameA
GetTickCount
DeleteCriticalSection
LocalFree
VirtualAlloc
GetLastError
EnterCriticalSection
GetModuleHandleW
InterlockedIncrement
GetProcessHeap
QueryPerformanceCounter
HeapDestroy
GetSystemTimeAsFileTime
LoadLibraryW
ReadFile
HeapAlloc
GetVersionExA
LocalAlloc
InterlockedExchange
LoadLibraryA
lstrlenW
FreeLibrary
lstrlenA
InterlockedCompareExchange
GetCurrentThreadId
CloseHandle
CreateThread
UnhandledExceptionFilter
MultiByteToWideChar
CreateFileW
user32
GetDlgItem
KillTimer
wsprintfA
shell32
ExtractAssociatedIconW
StrNCmpIW
SHBrowseForFolderA
ShellExecuteEx
FindExecutableW
SHGetFileInfo
RealShellExecuteExA
Control_RunDLLAsUserW
DragFinish
ShellExecuteExA
ExtractIconResInfoW
ShellExecuteA
DllRegisterServer
DragQueryFileAorW
DllInstall
Sections
.text Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ