Static task
static1
Behavioral task
behavioral1
Sample
3852142b0caacaeeb706b3d2bf085791_JaffaCakes118.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
3852142b0caacaeeb706b3d2bf085791_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
3852142b0caacaeeb706b3d2bf085791_JaffaCakes118
-
Size
5.2MB
-
MD5
3852142b0caacaeeb706b3d2bf085791
-
SHA1
3321a44ff6ff1cd3b4a4f61c07c558c96ebf89ab
-
SHA256
45e14105bc7ce86f050e8d17ad33067abba3436b363f774d76a4b25d6d683a8c
-
SHA512
b58a86879dfc70dee2b3c2f8658eb80cd58b665c1a83e1be4a9bff237be4d142800eaf8048596e01d01547890dd195b6aa8f1d2b918e0e3820e7b39a6ece9767
-
SSDEEP
98304:+Xwo4GdsZ/4eJ3PD8Ctln2is928MjGANFWTV9DeTKRYo6CISbob9LhgKtG:ToPdsZQedPDrpbsejGANFWTbiTKRz6HK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3852142b0caacaeeb706b3d2bf085791_JaffaCakes118
Files
-
3852142b0caacaeeb706b3d2bf085791_JaffaCakes118.exe windows:4 windows x86 arch:x86
006a33a471bbdc89dbf1cc7fe1500194
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateFileW
GetCurrentThread
GetProcAddress
InitializeCriticalSection
CloseHandle
LoadLibraryA
GetModuleHandleA
EnterCriticalSection
LocalAlloc
InterlockedExchange
GetProcessHeap
InterlockedCompareExchange
SetLastError
QueryPerformanceCounter
TerminateProcess
InterlockedIncrement
GetCurrentProcessId
GetStdHandle
TlsAlloc
CreateThread
GetModuleFileNameW
TlsGetValue
GetStartupInfoA
lstrcmpiW
DisableThreadLibraryCalls
GetLocalTime
SetHandleCount
GetVersionExW
GetTickCount
FreeEnvironmentStringsA
HeapCreate
ExitProcess
GetLocaleInfoA
VirtualFree
user32
IntersectRect
GetParent
FillRect
GetClientRect
wsprintfA
MessageBoxA
GetWindowLongW
LoadStringA
MessageBeep
IsIconic
SendMessageW
SetWindowPos
GetCursorPos
GetForegroundWindow
EqualRect
RegisterWindowMessageW
EndPaint
GetDC
UpdateWindow
ReleaseCapture
gdi32
GetViewportOrgEx
ExtSelectClipRgn
GetObjectType
DeleteDC
PlayMetaFile
StartDocW
CreateCompatibleDC
GetTextFaceW
GetTextExtentPoint32W
RectVisible
ExtTextOutA
CloseMetaFile
advapi32
ProcessTrace
CryptDestroyKey
CryptEncrypt
RegEnumKeyExW
RegEnumKeyA
RegEnumKeyW
RegCloseKey
RegEnumValueA
UpdateTraceA
CryptAcquireContextA
FlushTraceW
StopTraceW
msvcrt
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
Sections
.text Size: 4.4MB - Virtual size: 4.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 210KB - Virtual size: 366KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 135KB - Virtual size: 199KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 2KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 106KB - Virtual size: 105KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ