Static task
static1
Behavioral task
behavioral1
Sample
2dd3b67d45ff1f287aa1c624a3092dd2_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2dd3b67d45ff1f287aa1c624a3092dd2_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
2dd3b67d45ff1f287aa1c624a3092dd2_JaffaCakes118
-
Size
181KB
-
MD5
2dd3b67d45ff1f287aa1c624a3092dd2
-
SHA1
f7c864128a9662f938ce8b3a00139e4f40afc274
-
SHA256
6a5c48a741d558d57d4e5339a5ffe46f79d7d4f0dce0918aef4c69b56dfad6de
-
SHA512
0cb11f70672ed576100931e7887f4a79780ac89ace994a1d7ad246b9767da1a07d4035dbacfe49103c75697eb226b4bbab613748ec049823a190456d9802bdfe
-
SSDEEP
3072:NHthAaPVgW7aBty0+fL1SZB55HDCaR63rg:fhBVKngL4V5HWSUrg
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2dd3b67d45ff1f287aa1c624a3092dd2_JaffaCakes118
Files
-
2dd3b67d45ff1f287aa1c624a3092dd2_JaffaCakes118.exe windows:4 windows x86 arch:x86
410a4c2022ac97c7732842903034c9da
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
PathIsSystemFolderA
StrCSpnA
SHStrDupW
UrlUnescapeW
SHCreateStreamOnFileA
PathRemoveBackslashA
shell32
ord169
ord192
SHGetSpecialFolderLocation
ord149
SHParseDisplayName
DragFinish
gdi32
IntersectClipRect
GetCharWidthFloatA
DeleteDC
RestoreDC
GetSystemPaletteEntries
CreateFontIndirectW
comctl32
ord13
ord3
kernel32
CopyFileExW
ReadFile
SetHandleInformation
GetShortPathNameW
CreateProcessW
IsValidLocale
OpenMutexA
VirtualFreeEx
GetProcAddress
LoadLibraryA
GetModuleHandleA
lstrcmpiA
CreateThread
GetDriveTypeA
DeleteCriticalSection
IsValidCodePage
ConvertFiberToThread
CreatePipe
GetVersion
OpenEventW
DeleteFiber
GetConsoleFontSize
HeapWalk
GetStartupInfoA
user32
SetMenu
InsertMenuItemW
GetClassInfoW
GetDlgItemInt
UnhookWinEvent
GetListBoxInfo
GetAsyncKeyState
SendMessageTimeoutW
CreateMenu
CallNextHookEx
GetKeyNameTextA
EnableScrollBar
msvcrt
iswgraph
memchr
vfwprintf
feof
gmtime
putchar
ldiv
realloc
getenv
mktime
tmpfile
wcsncmp
ispunct
wcscoll
_c_exit
_exit
_XcptFilter
_cexit
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
memset
memmove
memcpy
_sleep
malloc
strtol
Sections
.text Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 150KB - Virtual size: 200KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE