Static task
static1
Behavioral task
behavioral1
Sample
3bf32e28dcdefac83bef6556cf759666_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3bf32e28dcdefac83bef6556cf759666_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
3bf32e28dcdefac83bef6556cf759666_JaffaCakes118
-
Size
23KB
-
MD5
3bf32e28dcdefac83bef6556cf759666
-
SHA1
ea9cd642a291f8e96752d1708414d76ed1b9a301
-
SHA256
b4595ca2b9144c5548fb95a8fa9e6fddb2ea8969f64daf4adf93b3786c44d7d5
-
SHA512
c7ef0b1356f919fec174fe179dfbe1975d39fb95468cf1dace3c94b40efd2530289a5cb39b859cd84f8a181ad492f2d9f03e77d1205a9e97735d759588f32d3e
-
SSDEEP
384:MBUD1mM3bCitnjsTPuUUEjPbLC8hWM6sNuNM4rkN1pJeYWSvXWxj35rlYmhofj:MBUBmGttgTPFjT2o3QMVpJeWX8Jrlbh0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3bf32e28dcdefac83bef6556cf759666_JaffaCakes118
Files
-
3bf32e28dcdefac83bef6556cf759666_JaffaCakes118.exe windows:5 windows x86 arch:x86
b7be63732fecd268c2f137b9dced9074
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetShortPathNameW
lstrcpyW
GlobalAddAtomA
lstrcpyA
GetThreadContext
GetConsoleCP
CloseHandle
GetCurrentThread
CreateEventA
AddAtomW
GetThreadTimes
GetCurrentProcess
LoadLibraryW
GetAtomNameA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetModuleFileNameA
GetModuleHandleA
GetSystemTime
GetCurrentThreadId
VirtualAlloc
WaitForSingleObject
GetProcAddress
LoadLibraryA
IsBadReadPtr
VirtualProtectEx
VirtualFree
Sleep
SystemTimeToFileTime
user32
DestroyWindow
GetLastActivePopup
GetWindowTextLengthA
DispatchMessageA
TranslateMessage
GetMessageA
UpdateWindow
ShowWindow
MessageBoxA
CreateWindowExA
RegisterClassExA
LoadCursorA
LoadIconA
Sections
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 700KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 176KB - Virtual size: 175KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ