Static task
static1
Behavioral task
behavioral1
Sample
3fd8075b5a9fbefd6672d090cfb0564a_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3fd8075b5a9fbefd6672d090cfb0564a_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
3fd8075b5a9fbefd6672d090cfb0564a_JaffaCakes118
-
Size
174KB
-
MD5
3fd8075b5a9fbefd6672d090cfb0564a
-
SHA1
32335a2b68a2509a79a27b15fec54ad60878a413
-
SHA256
b6e198eeb7e897abfdde50233036932def8d208f5304c1cec4fe9ef86722859e
-
SHA512
0dc9f42a5064ac90ae566614445754d3af78c4a337caa8e4bc8ec037f797f271a76f758dc0ba5697d7124dce8796b36660be9cabc637f3d6ec4980b9e9fa2ba1
-
SSDEEP
3072:oJLV6oIltCduMXQ642eNU86eSjKysyjOPa/53YhK:kLujCFQnKCSjKyxjgahI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3fd8075b5a9fbefd6672d090cfb0564a_JaffaCakes118
Files
-
3fd8075b5a9fbefd6672d090cfb0564a_JaffaCakes118.exe windows:4 windows x86 arch:x86
76d988b17c9327970518bf52e3436894
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
shell32
ShellExecuteA
Shell_NotifyIconA
rpcrt4
UuidCreate
shlwapi
GetAcceptLanguagesA
UrlCreateFromPathW
PathRemoveFileSpecW
PathIsRelativeW
PathFindExtensionW
StrCmpIW
PathAppendW
UrlUnescapeW
PathCreateFromUrlW
PathCombineW
kernel32
GetModuleHandleW
LocalFree
FindFirstFileW
GlobalFindAtomW
GetSystemDirectoryW
FindClose
LoadLibraryW
GetPrivateProfileStringW
GetSystemInfo
GetCurrentProcessId
LoadLibraryExW
SetFileAttributesW
CopyFileW
ExpandEnvironmentStringsW
WritePrivateProfileStringW
lstrcmpiW
WaitForSingleObject
GetProcessHeap
EnumResourceLanguagesA
CreateMutexW
HeapAlloc
FreeLibrary
LoadLibraryExA
FormatMessageW
HeapFree
ReleaseMutex
GetModuleHandleA
lstrlenA
GetProcAddress
FindNextFileW
GetCurrentDirectoryW
GetWindowsDirectoryA
GetPrivateProfileIntW
GetCurrentProcess
Sections
.text Size: 94KB - Virtual size: 490KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 76KB - Virtual size: 75KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ