Static task
static1
Behavioral task
behavioral1
Sample
426bf00bdb24c0575150aaaebd54445f_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
426bf00bdb24c0575150aaaebd54445f_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
426bf00bdb24c0575150aaaebd54445f_JaffaCakes118
-
Size
479KB
-
MD5
426bf00bdb24c0575150aaaebd54445f
-
SHA1
1f3d524c6fd7e9a7af4b1cdb6b4969e7fbff0470
-
SHA256
d9e1159639b270609be90e992df656dbaf1dad6edfa1d4223c633ac2a34edc9b
-
SHA512
ebf75e85c2a1c0df8c25d2f74a7ed1f485ab658b3fe871ee5179af72d49f22de3dc69c048ba4fe699a1cee1bea25dc2f7f87803ddbcaaf8db8b34d8c6174c427
-
SSDEEP
12288:gddeMP2BLc1oZDx8jt1wZMpWs1+DCwCFUlORMsJQyP0+qJkX+LydghuY7nxZHwJM:g7xJ0GyORMsJFzqWuLyC3zQu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 426bf00bdb24c0575150aaaebd54445f_JaffaCakes118
Files
-
426bf00bdb24c0575150aaaebd54445f_JaffaCakes118.exe windows:4 windows x86 arch:x86
7ae6573bdb3edeb28ef2f4940ec37f26
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
EnumSystemLocalesA
GetStringTypeA
GetFileAttributesA
EnumSystemCodePagesA
GetModuleFileNameW
WaitForSingleObject
HeapAlloc
VirtualFree
SetLastError
IsValidLocale
TlsAlloc
DebugBreak
GetLastError
FreeLibrary
SetEnvironmentVariableA
SetHandleCount
FreeEnvironmentStringsA
GetStartupInfoA
GetStartupInfoW
GlobalFindAtomW
MultiByteToWideChar
GetCommandLineW
GetStdHandle
GetCurrentThread
EnumTimeFormatsW
GetTimeZoneInformation
Sleep
GetProcessHeap
GetProcAddress
CompareStringA
GetOEMCP
TlsSetValue
VirtualProtect
GetCommandLineA
SystemTimeToFileTime
GetUserDefaultLCID
VirtualQuery
IsValidCodePage
TlsGetValue
LCMapStringW
FreeEnvironmentStringsW
HeapCreate
SetUnhandledExceptionFilter
GetLocaleInfoW
HeapReAlloc
IsDebuggerPresent
ExitProcess
FindFirstFileExW
GetStringTypeExW
VirtualAlloc
UnhandledExceptionFilter
QueryPerformanceCounter
GetCurrentProcess
InitializeCriticalSection
GetModuleHandleA
GetEnvironmentStringsW
HeapDestroy
HeapSize
GetCurrentThreadId
LeaveCriticalSection
WriteFile
GetCPInfo
GetFileType
GetCurrentProcessId
GetModuleFileNameA
InterlockedDecrement
GetACP
EnumResourceNamesW
GetTickCount
GetTimeFormatA
EnterCriticalSection
GetEnvironmentStrings
SetConsoleCtrlHandler
LCMapStringA
RtlUnwind
GetDateFormatA
GetSystemTimeAsFileTime
InterlockedExchange
InterlockedIncrement
DeleteCriticalSection
CompareStringW
GetLocaleInfoA
WideCharToMultiByte
GetStringTypeW
GetVersionExA
HeapFree
TerminateProcess
LoadLibraryA
DeleteAtom
TlsFree
shell32
DoEnvironmentSubstW
DragQueryPoint
ShellAboutA
SHFileOperationW
DragQueryFileAorW
SHFreeNameMappings
SHInvokePrinterCommandW
FindExecutableA
DoEnvironmentSubstA
SHAddToRecentDocs
ExtractAssociatedIconW
SHGetDesktopFolder
SHLoadInProc
comdlg32
ReplaceTextA
GetOpenFileNameW
PrintDlgA
ChooseFontW
FindTextW
PageSetupDlgW
GetSaveFileNameW
GetSaveFileNameA
GetFileTitleA
GetFileTitleW
ChooseColorA
PrintDlgW
gdi32
EnumFontFamiliesExW
DeviceCapabilitiesExA
SetPixelFormat
GetOutlineTextMetricsW
GetEnhMetaFileDescriptionA
CreatePolygonRgn
PolyBezier
GetTextExtentExPointA
CreatePalette
WidenPath
OffsetClipRgn
gdiPlaySpoolStream
GetRasterizerCaps
Sections
.text Size: 161KB - Virtual size: 160KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 312KB - Virtual size: 312KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ