Static task
static1
Behavioral task
behavioral1
Sample
44806f02352c93d29c301147ab6be4b2_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
44806f02352c93d29c301147ab6be4b2_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
44806f02352c93d29c301147ab6be4b2_JaffaCakes118
-
Size
111KB
-
MD5
44806f02352c93d29c301147ab6be4b2
-
SHA1
59de4fa834486d179fcc24102dd8e8ed07600cae
-
SHA256
02bb6fb57563e7849ba7e18ca60bc963a53b0e81e6b403c5c5541c0ec7879c3e
-
SHA512
f6ef89bfadaee71c326d2c00fe5b3eb8ad22fc1b94b76f91f4eceaeec804e43ab9d7b066e9b595b5bb73b9899e2ad779494cb5befb8ccfea0fb0528f4bdd58ba
-
SSDEEP
1536:/RQ39GarJq06DICJvhCGneVQ6fkFP2FDG5OSYFTx/tPa5D53pDIpI4jF/hZrnd:/MkarJqFICJAuhqSuQYFTqjDIj1hBd
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 44806f02352c93d29c301147ab6be4b2_JaffaCakes118
Files
-
44806f02352c93d29c301147ab6be4b2_JaffaCakes118.exe windows:4 windows x86 arch:x86
16835eac90013eb9aa0379185ac474ac
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
gdi32
CreateBitmap
CreateBrushIndirect
SelectObject
GetPaletteEntries
CreateFontIndirectA
CreatePenIndirect
SetBkMode
GetPixel
user32
GetDlgItem
SetFocus
IsWindowVisible
IsWindowEnabled
GetKeyboardLayoutList
GetScrollInfo
SetWindowPos
SendMessageW
CharNextA
DrawTextA
RedrawWindow
RemovePropA
GetDCEx
OpenClipboard
GetScrollPos
SetParent
SetWindowLongA
GetWindowThreadProcessId
AdjustWindowRectEx
GetKeyboardLayoutNameA
CharNextW
GetDesktopWindow
GetParent
PtInRect
GetCapture
RegisterClipboardFormatA
SystemParametersInfoA
EnableWindow
GetFocus
shell32
SHGetFileInfoA
SHGetFolderPathA
DragQueryFileA
SHFileOperationA
version
GetFileVersionInfoSizeA
VerFindFileA
kernel32
GetProcessHeap
GetModuleHandleA
VirtualAlloc
GetDiskFreeSpaceA
GetProcAddress
FindFirstFileA
MulDiv
DeleteFileA
LocalAlloc
VirtualFree
GetVersionExA
VirtualAllocEx
lstrlenA
ExitThread
FindClose
CompareStringA
Sections
CODE Size: 29KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
BSS Size: 74KB - Virtual size: 73KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
DATA Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ