Static task
static1
Behavioral task
behavioral1
Sample
394ba8217f5c880ef21057cf0768d1c6_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
394ba8217f5c880ef21057cf0768d1c6_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
394ba8217f5c880ef21057cf0768d1c6_JaffaCakes118
-
Size
160KB
-
MD5
394ba8217f5c880ef21057cf0768d1c6
-
SHA1
5fc527bab0d5f90d0c779344f83b6995204c9d0d
-
SHA256
3967e0570ccd3ae875307a97c464e37ace215a48421b20e19bc015ed039140f0
-
SHA512
da4c8947d2ee6caa690c4b21c8c34e63dbc5cec7c7d1141c61ff9c8a8e22342f5c51c29e22d7912c11f8ae76fe5e5b98019f24416af88150d4cdb9cc1de51e0f
-
SSDEEP
3072:uMh1h6eXdwCMMcBNcfGKpBN9Qu1in6orrHo+hnexHh9WGCOvLuO:3lvwdM+OfH1QABorHvBelvW/Ozz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 394ba8217f5c880ef21057cf0768d1c6_JaffaCakes118
Files
-
394ba8217f5c880ef21057cf0768d1c6_JaffaCakes118.exe windows:1 windows x86 arch:x86
9f8589281485ecf07896417401f6e1d9
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
RtlUnwind
GlobalLock
SetEvent
GetStartupInfoA
QueryPerformanceCounter
FormatMessageA
GlobalAddAtomW
CloseHandle
ExitThread
GetModuleHandleA
GetFileTime
TerminateProcess
SetLastError
GetModuleFileNameA
CreateToolhelp32Snapshot
FreeEnvironmentStringsW
msvcrt
_wtoi
_ismbbkalnum
_ismbcalpha
tan
wcspbrk
memmove
memcpy
_except_handler3
_XcptFilter
_exit
_mbcjmstojis
exit
_ismbstrail
_acmdln
_ismbcupper
fwrite
__setusermatherr
_adjust_fdiv
_mbsnbcmp
__set_app_type
_mbsrchr
_mbslwr
_wgetcwd
_initterm
_controlfp
_cwait
__p__commode
ungetwc
_wfdopen
__p__fmode
strtol
_wasctime
__getmainargs
gdi32
CreatePen
RectInRegion
SelectObject
GetDeviceCaps
SetBkMode
GetBkColor
CreateSolidBrush
CreateFontIndirectA
Polyline
MoveToEx
StartDocA
SetROP2
ExtTextOutA
DeleteDC
SetMapMode
SelectClipRgn
user32
SetClassLongA
RemoveMenu
GetParent
GetDC
Sections
.text Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 136KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 139KB - Virtual size: 139KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ