Static task
static1
Behavioral task
behavioral1
Sample
2a78cb82f49851d5e271490a23e80c85_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2a78cb82f49851d5e271490a23e80c85_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
2a78cb82f49851d5e271490a23e80c85_JaffaCakes118
-
Size
285KB
-
MD5
2a78cb82f49851d5e271490a23e80c85
-
SHA1
3c2985407108ea4c7b2c4356624776accba53612
-
SHA256
1eedd6cbfd9f68fc0bafe887dcb969f0d9479af56725118eaa68625f06c54bd9
-
SHA512
cd1b4f031b7300b0e5463e35a6382f2e059c75e9f6eab83ff04f27f93967f9d045756c15943c748e24f93c1abbf9d90d0f33d9ccec455ffa183a094cc321631d
-
SSDEEP
3072:7D5RPmzg1u7RXmtJJFCzo/wZVXMfSJQPGyRWW/AFvkyW8iZZoDlBS75moeEAJ9np:X5RPmxF4412SuPN/AFvTFaZ2GsoeKax
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2a78cb82f49851d5e271490a23e80c85_JaffaCakes118
Files
-
2a78cb82f49851d5e271490a23e80c85_JaffaCakes118.exe windows:4 windows x86 arch:x86
72b50d95b3c0f98b2ec6286de13aca2c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
gdi32
CreateDIBPatternBrush
EnumFontsA
ArcTo
PlgBlt
SetICMProfileA
GetMetaFileBitsEx
SetBitmapBits
Polyline
CreateDCA
Escape
GetBkColor
CreateColorSpaceW
GetOutlineTextMetricsW
SetWorldTransform
GetLayout
SetPixelFormat
ExtFloodFill
advapi32
CryptSetProviderA
RegEnumValueA
CryptVerifySignatureW
CryptSignHashA
RegOpenKeyExW
InitializeSecurityDescriptor
RegSetValueExA
CryptSetProviderW
LookupAccountSidW
LookupPrivilegeValueW
LookupSecurityDescriptorPartsW
shell32
InternalExtractIconListA
SHGetDataFromIDListW
ShellExecuteW
ExtractIconEx
ExtractAssociatedIconA
InternalExtractIconListW
SHChangeNotify
SheChangeDirA
SHGetSpecialFolderLocation
RealShellExecuteExA
SHBrowseForFolderW
SHBrowseForFolderA
SHGetFileInfoW
ShellExecuteA
FindExecutableW
FindExecutableA
ShellHookProc
SHInvokePrinterCommandW
SHGetInstanceExplorer
CommandLineToArgvW
ShellExecuteExW
DragQueryFileAorW
SHGetDataFromIDListA
comdlg32
ReplaceTextW
GetFileTitleA
kernel32
InterlockedIncrement
InitializeCriticalSection
LoadModule
FlushConsoleInputBuffer
RtlUnwind
WriteProfileSectionW
GetACP
GetTimeZoneInformation
LoadLibraryA
SetUnhandledExceptionFilter
GetModuleFileNameA
GetStringTypeA
EnterCriticalSection
VirtualAlloc
FindAtomA
GetProcAddress
HeapSize
CompareStringA
TerminateProcess
TlsFree
GetCurrentProcess
FreeEnvironmentStringsA
GetTickCount
GetTimeFormatA
LeaveCriticalSection
ExitProcess
FreeLibrary
GetOEMCP
GetModuleHandleA
QueryPerformanceCounter
GetCPInfo
SetConsoleCtrlHandler
VirtualQuery
SetHandleCount
GetStartupInfoA
GetSystemInfo
InterlockedDecrement
SetLastError
HeapDestroy
TlsGetValue
GetLocaleInfoA
OpenMutexW
GetLocaleInfoW
GetEnvironmentStringsW
GetStringTypeW
MultiByteToWideChar
HeapFree
GetLongPathNameA
WideCharToMultiByte
IsValidLocale
Sleep
GetCurrentProcessId
LCMapStringA
GetDateFormatW
GetStdHandle
SetEnvironmentVariableA
GetDateFormatA
UnhandledExceptionFilter
FreeEnvironmentStringsW
TlsSetValue
GetLastError
TlsAlloc
DeleteCriticalSection
EnumSystemLocalesA
GetSystemTimeAsFileTime
GetCurrentThread
HeapCreate
HeapAlloc
GetVersionExA
InterlockedExchange
IsDebuggerPresent
GetCommandLineA
GetUserDefaultLCID
IsValidCodePage
GetProcessHeap
LCMapStringW
GetCurrentThreadId
CompareStringW
HeapReAlloc
GetFileType
WriteFile
VirtualFree
GetEnvironmentStrings
user32
SetLastErrorEx
wsprintfW
wsprintfA
LoadMenuIndirectW
SetProcessDefaultLayout
GetPropA
SetMenuItemInfoA
GetAsyncKeyState
ChildWindowFromPointEx
MenuItemFromPoint
GetProcessDefaultLayout
DestroyIcon
EnumDisplayDevicesW
ReleaseCapture
PostThreadMessageW
UnregisterDeviceNotification
GetClassWord
SetMenuItemBitmaps
ShowOwnedPopups
FindWindowW
EnumPropsExW
Sections
.text Size: 137KB - Virtual size: 136KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 139KB - Virtual size: 169KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ