Static task
static1
Behavioral task
behavioral1
Sample
3f06eccb0f9e94d7d5dcd682c479ca50_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3f06eccb0f9e94d7d5dcd682c479ca50_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
3f06eccb0f9e94d7d5dcd682c479ca50_JaffaCakes118
-
Size
356KB
-
MD5
3f06eccb0f9e94d7d5dcd682c479ca50
-
SHA1
2eeb5e8c4111759981ba4c5ca55fb85519cea779
-
SHA256
f8ecad3b4bfb20e455cf2cd6d8cd4a9c34f97816f5f447b241a2582b3068b031
-
SHA512
d70099476fb97545ad468aee66936eff9381bf3ae6b432ba612f0d3b739f738c28a95a3d6b5f9a1c73cd49a55d42d1a4e30c97df2b4e2ddc09725916384088f2
-
SSDEEP
6144:UD/emPf0fG7b+RpFBkR16t8nJMtGXKUEaoVfYrw/gxL4J4Ca5xyD:UXPf0fG7bW3jtUJrufYrmM+4C6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3f06eccb0f9e94d7d5dcd682c479ca50_JaffaCakes118
Files
-
3f06eccb0f9e94d7d5dcd682c479ca50_JaffaCakes118.exe windows:5 windows x86 arch:x86
0d903a462bb2de77399e76a116a56061
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleFileNameW
GetModuleHandleW
GetPrivateProfileSectionW
GetPrivateProfileStringW
GetProcAddress
GetStartupInfoW
GetSystemTimeAsFileTime
GetTempFileNameW
GetThreadLocale
GetTickCount
GetWindowsDirectoryW
GlobalAlloc
GlobalFree
GlobalLock
GlobalReAlloc
GlobalSize
GlobalUnlock
LoadLibraryExW
LoadLibraryW
LoadResource
LocalAlloc
LocalFree
GetLastError
MoveFileW
MulDiv
MultiByteToWideChar
QueryPerformanceCounter
RemoveDirectoryW
SearchPathW
SetErrorMode
SetFileAttributesW
SetFilePointer
SetLastError
SetUnhandledExceptionFilter
TerminateProcess
UnhandledExceptionFilter
WinExec
WriteFile
WritePrivateProfileStringW
lstrcmpW
lstrcmpiW
lstrcpynW
lstrlenA
lstrlenW
GetEnvironmentVariableW
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
GetCommandLineW
FreeResource
FreeLibrary
FindResourceW
FindFirstFileW
FindClose
ExpandEnvironmentStringsW
ExitProcess
EnumResourceNamesW
DeleteFileW
CreateFileW
CloseHandle
GetDriveTypeA
VirtualAlloc
LockResource
ReadFile
user32
PeekMessageW
MessageBoxW
LookupIconIdFromDirectory
LoadStringW
LoadCursorW
GetSystemMetrics
GetSystemMenu
GetLastActivePopup
ReleaseDC
GetDC
GetClientRect
EnableMenuItem
DispatchMessageW
DestroyWindow
CreateDialogParamW
CopyRect
CharNextW
LoadIconW
SendDlgItemMessageW
SystemParametersInfoW
SetForegroundWindow
SetDlgItemTextW
GetDlgItem
SetCursor
gdi32
GetTextExtentPointW
GetTextExtentExPointW
GetStockObject
GetDeviceCaps
advapi32
RegEnumKeyExW
RegSetValueW
RegSetValueExW
RegQueryValueW
RegQueryValueExW
RegOpenKeyExA
RegCloseKey
RegCreateKeyW
RegDeleteKeyW
RegEnumKeyW
RegEnumValueW
RegOpenKeyExW
RegOpenKeyW
RegQueryInfoKeyW
shell32
SHAddToRecentDocs
SHChangeNotify
SHGetPathFromIDListW
SHGetSpecialFolderLocation
ShellExecuteExW
FindExecutableW
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
msvcrt
_vsnwprintf
memmove
memcpy
Sections
.text Size: 329KB - Virtual size: 328KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text3 Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text2 Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data3 Size: 1024B - Virtual size: 1000B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data2 Size: 1024B - Virtual size: 1000B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ