Static task
static1
Behavioral task
behavioral1
Sample
3d0dffcd58e2f95205bca0d22f6f7c9e_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3d0dffcd58e2f95205bca0d22f6f7c9e_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
3d0dffcd58e2f95205bca0d22f6f7c9e_JaffaCakes118
-
Size
48KB
-
MD5
3d0dffcd58e2f95205bca0d22f6f7c9e
-
SHA1
001b50b74be71b76341096a2741b920b254aa8b9
-
SHA256
9c02dace3a3f97711bc14b17d18475f07db3d69e7d247df0529866b17df4b2b4
-
SHA512
9ddb81b06cc6773e1500344a9357b65eef9bdaa1419e3d8eb24dfdfe82833d814def46a360ebfd9fba801db7cdcf72b83b555ca976f834148a5c1132e7846173
-
SSDEEP
384:Rh8cQ9S6bqjENdNTK+uforbF2FF84NvWdZeru8pcexaATQMUXiSAQ6crGgVuuflM:ccQwebmQrbeF84nTBahBXfHJfQIkcv
Malware Config
Signatures
Files
-
3d0dffcd58e2f95205bca0d22f6f7c9e_JaffaCakes118.exe windows:4 windows x86 arch:x86
48fcbf0a8764dc47dc81761c628ff1a6
Code Sign
03:c7:8f:37:db:92:28:df:3c:bb:1a:ad:82:fa:67:10Certificate
IssuerOU=VeriSign Commercial Software Publishers CA,O=VeriSign\, Inc.,L=InternetNot Before09/04/1996, 00:00Not After07/01/2004, 23:59SubjectOU=VeriSign Commercial Software Publishers CA,O=VeriSign\, Inc.,L=Internetfc:a4:a5:9f:2c:0f:c0:b9:03:98:33:1b:7b:54:54:1dCertificate
IssuerOU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust NetworkNot Before16/11/1999, 00:00Not After06/01/2004, 23:59SubjectCN=VeriSign Time Stamping Service CA SW1,OU=VeriSign Trust Network+OU=www.verisign.com/repository/RPA Incorp. by Ref.\,LIAB.LTD(c)98,O=VeriSign\, Inc.Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
75:f2:8e:f8:a8:fb:ea:6d:11:52:97:14:95:4b:65:5cCertificate
IssuerOU=VeriSign Commercial Software Publishers CA,O=VeriSign\, Inc.,L=InternetNot Before04/04/2000, 00:00Not After17/04/2001, 23:59SubjectCN=Microsoft Corporation,OU=VeriSign Commercial Software Publishers CA+OU=www.verisign.com/repository/RPA Incorp. by Ref.\,LIAB.LTD(c)98+OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Microsoft Corporation,O=VeriSign\, Inc.,L=Internet+L=Redmond,ST=Washington,C=USKey Usages
KeyUsageDigitalSignature
KeyUsageKeyEncipherment
Signer
Actual PE DigestDigest AlgorithmPE Digest MatchesfalseHeaders
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ole32
CoTaskMemFree
CoUninitialize
CoInitializeSecurity
CoInitialize
StringFromCLSID
CoDisconnectObject
CoCreateInstance
StringFromGUID2
kernel32
LoadLibraryA
LocalFree
InterlockedDecrement
GetLastError
InterlockedIncrement
GetVersionExA
WaitForSingleObject
GetUserDefaultLangID
SetUnhandledExceptionFilter
GetCurrentThreadId
CloseHandle
WriteFile
SetLastError
GetCurrentProcessId
InterlockedExchange
OpenFileMappingA
OpenEventA
RaiseException
CreateEventA
CreateFileMappingA
ResetEvent
SetEvent
MapViewOfFile
UnmapViewOfFile
GetCommandLineA
GetModuleHandleA
GetStartupInfoW
HeapReAlloc
LocalAlloc
GetProcessHeap
HeapFree
ExitProcess
TerminateProcess
GetCurrentProcess
LoadLibraryW
WideCharToMultiByte
FormatMessageA
FreeLibrary
GetProcAddress
ReleaseMutex
CreateMutexA
HeapAlloc
user32
MessageBoxW
SetForegroundWindow
DefWindowProcA
CreateWindowExA
RegisterClassA
DestroyWindow
PostMessageA
GetDesktopWindow
MessageBoxA
LoadImageA
GetSystemMetrics
advapi32
RegOpenKeyExW
RegQueryValueExA
RegOpenKeyExA
RegQueryValueExW
RegCloseKey
Sections
.text Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ