Static task
static1
Behavioral task
behavioral1
Sample
3af89d9b82e0da09abbddca910ca3144_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3af89d9b82e0da09abbddca910ca3144_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
3af89d9b82e0da09abbddca910ca3144_JaffaCakes118
-
Size
466KB
-
MD5
3af89d9b82e0da09abbddca910ca3144
-
SHA1
91b995ba833164a88ec1c71e43a2c68a55710b60
-
SHA256
1240c440fce99452bed92598ba841e8c88d3ba04e08633d0afd267ae01c37ed4
-
SHA512
116ae4b2b3b8434391575c980ece9353596ebd9927cc0b15b359be056c43d57d635d88545e5c9dacacea4703f734213acf8e3b9ed7bf1bda270ac70a623c52c6
-
SSDEEP
6144:yqHOFN87/M3bo33Dl/aDOWZ7EF3v5QUIw84RtxtWt0eDnAnBDdnEi6G:yjNIc+ZsxZoBBQ1r4Rt6t0eDQGi6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3af89d9b82e0da09abbddca910ca3144_JaffaCakes118
Files
-
3af89d9b82e0da09abbddca910ca3144_JaffaCakes118.exe windows:4 windows x86 arch:x86
48921cdc10c024c58081697ab84ce707
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WriteConsoleOutputCharacterW
GetLocaleInfoA
FindFirstFileA
GetCurrencyFormatA
GetCurrentThread
GetDriveTypeA
HeapAlloc
SetLastError
IsValidLocale
HeapCreate
LeaveCriticalSection
UnhandledExceptionFilter
GetWindowsDirectoryW
CompareStringA
TlsSetValue
IsValidCodePage
TlsFree
GetEnvironmentStringsW
GetFileType
GlobalFlags
InterlockedDecrement
EnumSystemLocalesA
GetLastError
FreeEnvironmentStringsA
TransactNamedPipe
GetOEMCP
LCMapStringW
GetEnvironmentStrings
GetProcAddress
GetUserDefaultLangID
GetDateFormatA
SetEnvironmentVariableA
WaitCommEvent
EnterCriticalSection
RtlFillMemory
GetProcessHeap
VirtualQuery
GetVersionExA
SetConsoleCtrlHandler
HeapSize
GetSystemInfo
GetStartupInfoW
LCMapStringA
GetCommandLineW
HeapReAlloc
GetUserDefaultLCID
ExitProcess
WaitForMultipleObjects
WideCharToMultiByte
VirtualAlloc
SetHandleCount
QueryPerformanceCounter
GetCurrentProcess
GetStringTypeW
GetModuleHandleA
GetACP
GetStdHandle
GetStringTypeA
GetCurrentThreadId
InitializeCriticalSection
Sleep
DeleteCriticalSection
GetCPInfo
GetCurrentProcessId
TlsGetValue
GetTimeFormatA
CompareStringW
MapViewOfFileEx
GetTickCount
GetModuleFileNameW
DeleteFileA
FreeLibrary
InterlockedIncrement
HeapDestroy
RtlUnwind
FreeEnvironmentStringsW
GetSystemTimeAsFileTime
WriteFile
GetTimeZoneInformation
GetDiskFreeSpaceExW
SetConsoleScreenBufferSize
GetCommandLineA
TlsAlloc
GetLocaleInfoW
GetStartupInfoA
HeapFree
TerminateProcess
LoadLibraryA
CreateDirectoryExA
MultiByteToWideChar
VirtualFree
FindAtomA
GetModuleFileNameA
IsDebuggerPresent
GetExitCodeProcess
SetUnhandledExceptionFilter
FormatMessageA
InterlockedExchange
wininet
InternetConnectW
SetUrlCacheEntryGroupW
InternetOpenUrlA
InternetAutodial
InternetQueryOptionA
FtpPutFileA
InternetInitializeAutoProxyDll
InternetFortezzaCommand
FtpCreateDirectoryA
InternetConfirmZoneCrossingW
InternetConfirmZoneCrossing
GetUrlCacheGroupAttributeA
InternetQueryDataAvailable
SetUrlCacheEntryInfoA
shell32
SHGetSpecialFolderPathA
ExtractIconA
DoEnvironmentSubstA
SHLoadInProc
DragQueryPoint
DragQueryFileAorW
SHFreeNameMappings
ShellAboutW
SHFileOperation
DuplicateIcon
SheSetCurDrive
ExtractAssociatedIconExW
ExtractIconW
ShellExecuteA
SHAddToRecentDocs
SHGetMalloc
SHFileOperationW
SHGetSpecialFolderLocation
user32
RegisterClipboardFormatW
CreateCaret
CharToOemW
GetDlgItemTextW
EnumChildWindows
DdePostAdvise
SubtractRect
ArrangeIconicWindows
LoadMenuW
DlgDirListA
GetComboBoxInfo
WindowFromPoint
GetCapture
InvalidateRgn
EnumDisplaySettingsExA
GetUpdateRgn
GetWindowPlacement
Sections
.text Size: 149KB - Virtual size: 148KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 313KB - Virtual size: 326KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ