Static task
static1
Behavioral task
behavioral1
Sample
3fd4c08109b6f2b6353a64bfd763f9c5_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3fd4c08109b6f2b6353a64bfd763f9c5_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
3fd4c08109b6f2b6353a64bfd763f9c5_JaffaCakes118
-
Size
156KB
-
MD5
3fd4c08109b6f2b6353a64bfd763f9c5
-
SHA1
b5425d0ea029c53dcbe75f5978c7744384de76a7
-
SHA256
e3eee582dd00f3683c5ba8cd5fd9ade6713d4feee69fb2d24a14982899f2a94f
-
SHA512
5f872cb07a0501ccefa38e4cc9160560f2e610c1f203f6a2e03eba55e87256fd134826e93d4671ec02304617abee9a0458e22b471e8b0acfa3bac92af4062d75
-
SSDEEP
768:pXtuCNba87ebyOqAILhDBtEhd0VovonkM:pXj48vOUrtEhtxM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3fd4c08109b6f2b6353a64bfd763f9c5_JaffaCakes118
Files
-
3fd4c08109b6f2b6353a64bfd763f9c5_JaffaCakes118.exe windows:4 windows x86 arch:x86
c3dabbbfd7dc35ce87d6eae020a19f8a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
FindWindowExA
FindWindowA
ExitWindowsEx
DispatchMessageA
DefWindowProcA
CreateWindowExA
TranslateMessage
SetTimer
SetForegroundWindow
ReleaseDC
RegisterClassExA
PostQuitMessage
PostMessageA
LoadIconA
LoadCursorA
KillTimer
IsWindow
GetWindowThreadProcessId
GetMessageA
GetDC
wsprintfA
kernel32
CreateProcessA
DeleteFileA
ExitProcess
GetCurrentProcess
GetModuleFileNameA
GetStartupInfoA
GetSystemDirectoryA
CreateFileA
GetTempPathA
GetTickCount
GetVersionExA
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
LocalAlloc
LocalFree
MultiByteToWideChar
OpenProcess
SetEndOfFile
SetFilePointer
Sleep
TerminateProcess
WideCharToMultiByte
lstrcatA
lstrcmpA
lstrcmpiA
lstrcpyA
lstrcpynA
lstrlenA
CloseHandle
GetFileSize
ReadFile
GetProcessHeap
HeapAlloc
HeapFree
GetSystemTimeAsFileTime
advapi32
RegQueryValueExA
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
wininet
InternetReadFile
InternetQueryDataAvailable
InternetOpenUrlA
InternetOpenA
InternetGetConnectedState
InternetConnectA
InternetCloseHandle
HttpSendRequestA
HttpOpenRequestA
FindNextUrlCacheEntryA
FindFirstUrlCacheEntryA
DeleteUrlCacheEntryA
urlmon
URLDownloadToFileA
gdi32
StretchBlt
SelectObject
TextOutA
GetTextExtentPoint32A
GetObjectA
GetDIBits
DeleteObject
DeleteDC
CreateFontA
CreateCompatibleDC
CreateCompatibleBitmap
CreateDIBSection
PatBlt
CreateDIBitmap
ole32
CoCreateInstance
OleUninitialize
OleInitialize
oleaut32
SysAllocString
SysFreeString
VariantInit
Sections
.text Size: 26KB - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 126KB - Virtual size: 145KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE