Static task
static1
Behavioral task
behavioral1
Sample
384449b77597adfd490a4590001bd154_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
384449b77597adfd490a4590001bd154_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
384449b77597adfd490a4590001bd154_JaffaCakes118
-
Size
247KB
-
MD5
384449b77597adfd490a4590001bd154
-
SHA1
8b484ac4f8ed4c8bb91cf73a363eeee963f4ea2e
-
SHA256
c1780f705db806d56851a690ecba56252bd3441a3d9290bbaf232ba1902e58e8
-
SHA512
492fdc40b15fb03630a4785a49f5af8a7633526f49228969874965133a458806cc96cd8df5a51fb364fb3e7dd198f6e4638a01edfeca015b4e640382d7d3787f
-
SSDEEP
3072:in7PZ3/kEbiz60LUQNTjeqXo4CJbRBLue+OCgXyP+Suc5R5Fyr9yGITONGWQWZpL:i93tcqWjeMjCPBKyCpuc/5FycyNGWx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 384449b77597adfd490a4590001bd154_JaffaCakes118
Files
-
384449b77597adfd490a4590001bd154_JaffaCakes118.exe windows:4 windows x86 arch:x86
c9755c7285fceff7591d2042032fb8b4
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
gdi32
GetCharABCWidthsFloatW
CopyMetaFileA
MoveToEx
GetWorldTransform
CreatePolygonRgn
GetWinMetaFileBits
GetGlyphOutlineA
CreateEllipticRgnIndirect
SelectPalette
EnumFontFamiliesExA
CreateCompatibleDC
CreateDIBSection
GetAspectRatioFilterEx
GetKerningPairsA
GetRandomRgn
GetColorAdjustment
PolyPolygon
SetWindowOrgEx
GetCurrentObject
GetMetaFileBitsEx
SetDIBColorTable
GetBkColor
ExcludeClipRect
Escape
ArcTo
wininet
InternetTimeToSystemTimeA
InternetGoOnline
FtpCommandA
InternetCombineUrlW
UrlZonesDetach
InternetCanonicalizeUrlA
UnlockUrlCacheEntryFile
SetUrlCacheHeaderData
UnlockUrlCacheEntryStream
DeleteIE3Cache
InternetTimeFromSystemTimeW
InternetReadFileExW
InternetTimeToSystemTimeW
HttpSendRequestA
FtpFindFirstFileA
CreateUrlCacheEntryW
InternetErrorDlg
advapi32
RegCreateKeyExA
CryptGetHashParam
RegSetValueExA
CryptHashData
RegCreateKeyExW
RegQueryValueA
RegRestoreKeyA
CryptDeriveKey
GetUserNameA
DuplicateTokenEx
InitializeSecurityDescriptor
CryptVerifySignatureA
CryptEnumProvidersW
RegReplaceKeyA
CryptSetProvParam
RegLoadKeyA
RegQueryMultipleValuesW
shell32
DragQueryFileAorW
SHFormatDrive
ShellAboutA
SHGetFileInfo
SheChangeDirExW
ExtractAssociatedIconExA
SHGetFileInfoW
ShellAboutW
SHInvokePrinterCommandA
DragFinish
RealShellExecuteExW
SHUpdateRecycleBinIcon
ShellExecuteExA
ExtractAssociatedIconA
kernel32
GetEnvironmentStringsW
CompareStringA
GetLocaleInfoW
GetOEMCP
LCMapStringW
GetCPInfo
GetProcAddress
LeaveCriticalSection
TransactNamedPipe
UnhandledExceptionFilter
FreeEnvironmentStringsA
HeapDestroy
CompareStringW
GetLocaleInfoA
GetCurrentThreadId
MultiByteToWideChar
SetHandleCount
GetVersionExA
HeapReAlloc
InitializeCriticalSection
HeapAlloc
TlsAlloc
GetFileType
GetCommandLineA
WaitNamedPipeA
TlsGetValue
GetACP
EnumSystemLocalesA
GetModuleHandleA
IsValidCodePage
ExitProcess
TlsSetValue
LocalFlags
GetStartupInfoA
EnterCriticalSection
LoadLibraryA
GetLastError
SetEnvironmentVariableA
HeapFree
GlobalFree
GetTimeFormatA
GetDateFormatA
IsBadWritePtr
HeapCreate
GetModuleFileNameA
WriteFile
RtlUnwind
SetLastError
TlsFree
GetCurrentProcessId
GetSystemTimeAsFileTime
GetStringTypeW
InterlockedExchange
VirtualFree
GetTickCount
FreeEnvironmentStringsW
VirtualQuery
GetTimeZoneInformation
HeapValidate
HeapSize
VirtualProtect
GetCurrentThread
GetStdHandle
GetEnvironmentStrings
LCMapStringA
WideCharToMultiByte
DeleteCriticalSection
GetCurrentProcess
QueryPerformanceCounter
GetStringTypeA
GetUserDefaultLCID
GetSystemInfo
IsValidLocale
VirtualAlloc
TerminateProcess
Sections
.text Size: 128KB - Virtual size: 127KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 111KB - Virtual size: 110KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ