Static task
static1
Behavioral task
behavioral1
Sample
4210dab864d43f30c66498580f4259f1_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
4210dab864d43f30c66498580f4259f1_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
4210dab864d43f30c66498580f4259f1_JaffaCakes118
-
Size
156KB
-
MD5
4210dab864d43f30c66498580f4259f1
-
SHA1
4e2d888a48e00b4f34d21e87dfdd27accab2ac01
-
SHA256
a800b2a0006e021e6feb516071d46c40f1be7c6bd6268941c29b740c93108c8d
-
SHA512
f7e40986ff2172e26886d427a5e5af43fb9640c54b5c48ef8376254ee1b1b866df8d3cf206b48dd9594288dc8b7fbf91f8066449e76a0fbac6323ecc2a785bbb
-
SSDEEP
3072:AP2I3j9R3aCXBecRPcNW9f06bdJa6JBkmVZoUsC4h9CQVKFu71:APB3hR3aCXEcmK06fpo1p5Vqu71
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4210dab864d43f30c66498580f4259f1_JaffaCakes118
Files
-
4210dab864d43f30c66498580f4259f1_JaffaCakes118.exe windows:4 windows x86 arch:x86
daa3b24267ae2e0fcf8105a1bf0e06d5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
comdlg32
GetOpenFileNameA
ChooseFontA
GetSaveFileNameA
CommDlgExtendedError
shlwapi
PathIsUNCW
kernel32
GetVersionExA
GetPrivateProfileStringW
GetFileAttributesW
GetModuleFileNameW
LoadLibraryW
SuspendThread
WaitForMultipleObjects
CreateEventW
FindNextFileW
OutputDebugStringW
user32
CharPrevW
CharNextW
LoadStringW
MessageBoxW
IsDlgButtonChecked
SetFocus
GetDlgItem
CheckRadioButton
DialogBoxParamW
GetDlgItemTextW
MessageBoxExW
gdi32
DeleteObject
advapi32
RegCreateKeyA
RegCloseKey
RegSetValueA
RegSetValueExA
RegOpenKeyExA
RegEnumKeyExA
RegDeleteKeyA
gdiplus
GdipDeleteGraphics
GdipAlloc
GdipFree
GdipDisposeImage
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipGetImagePalette
GdipCreateBitmapFromFile
GdipBitmapLockBits
GdipCloneImage
ole32
CoTaskMemAlloc
CoIsHandlerConnected
CoGetStdMarshalEx
CoTestCancel
CoInitialize
CoTaskMemFree
Sections
.text Size: 136KB - Virtual size: 135KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 308B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ