Static task
static1
Behavioral task
behavioral1
Sample
3dc525d8337acfde4159496e8a5579c8_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3dc525d8337acfde4159496e8a5579c8_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
3dc525d8337acfde4159496e8a5579c8_JaffaCakes118
-
Size
64KB
-
MD5
3dc525d8337acfde4159496e8a5579c8
-
SHA1
27ef228b5a1d9eb59fab965783dd66949e0fb388
-
SHA256
bf52c2955ec557347878cf1cfb88f154a86d925fb54abc5460eff747184f4881
-
SHA512
d9e48d5b24f868b288b81871a670465577a32126f67b3f1a0e21f3838490dd2cfd9b3a5154bb530552568f2235a12625aa888abc3497fb9199cdb872f4e6a221
-
SSDEEP
1536:1Lu/jd+lN32LzRsYL2hpA6gidCJw7DGyzujjI+jC1S9:Bu/jd+lN30RsfHGVaY/l
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3dc525d8337acfde4159496e8a5579c8_JaffaCakes118
Files
-
3dc525d8337acfde4159496e8a5579c8_JaffaCakes118.exe windows:4 windows x86 arch:x86
b95faa227419b427d8c231f76c574330
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
user32
GetWindowLongA
SendMessageA
GetClipboardData
GetMessageA
SetProcessWindowStation
DispatchMessageA
GetKeyboardState
CloseWindowStation
DrawIcon
CharLowerBuffA
OpenWindowStationA
FindWindowExA
GetCursorPos
GetWindowTextA
GetForegroundWindow
ToUnicode
kernel32
VirtualAlloc
HeapFree
FindResourceW
GetFileAttributesA
GetModuleHandleA
FindNextFileW
GetFileSizeEx
VirtualProtect
GetLastError
CreateFileA
GlobalUnlock
CreateProcessW
SetFilePointer
SetFileTime
advapi32
RegEnumKeyExA
CryptHashData
CryptAcquireContextW
GetUserNameW
CryptDestroyHash
CryptGetHashParam
RegCloseKey
RegDeleteValueA
DuplicateTokenEx
RegSetValueExA
CryptCreateHash
shlwapi
PathRemoveFileSpecW
PathFindFileNameW
PathMatchSpecW
wvnsprintfA
SHDeleteKeyA
PathFileExistsW
StrCmpNIA
StrStrW
wnsprintfA
wnsprintfW
PathCombineW
wvnsprintfW
Sections
.text Size: 58KB - Virtual size: 58KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE