Static task
static1
Behavioral task
behavioral1
Sample
440c417ffbaf7c2de0bdd1141cfb53c2_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
440c417ffbaf7c2de0bdd1141cfb53c2_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
440c417ffbaf7c2de0bdd1141cfb53c2_JaffaCakes118
-
Size
169KB
-
MD5
440c417ffbaf7c2de0bdd1141cfb53c2
-
SHA1
45c6d3af9a5c09fd139984b3ff7e7e463a90c873
-
SHA256
b067eee5ee62f3b93ac40d4a515aa82e8b24ec10b4f23d43c958e8e10b3316d0
-
SHA512
f7515100653fc7a34140505609a533937b34f07a9b6a7dc54479b47fc34cf6c6f039b8dc924c3ba3f1ff893c37fa54dca955ae0b69df0b33f0afd7b357c53532
-
SSDEEP
3072:pZU2l9GhCscZ9Ff870ZZg4ks0/nfxdNTZ0QWxNFrDN0F7lx/BMBkM9kMb:zU2lkCp38n4kzTNTZtSJDNWzBMBkW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 440c417ffbaf7c2de0bdd1141cfb53c2_JaffaCakes118
Files
-
440c417ffbaf7c2de0bdd1141cfb53c2_JaffaCakes118.exe windows:5 windows x86 arch:x86
b9679d3c7a6bb7da280b0ca393eda215
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetThreadLocale
GetACP
GetUserDefaultLangID
lstrcmpiW
GetConsoleOutputCP
GetCurrentProcess
CopyFileA
RemoveDirectoryA
GetStartupInfoA
lstrcmpiA
SetCurrentDirectoryA
lstrcmpA
MulDiv
GetWindowsDirectoryA
GetProcessHeap
lstrlenW
GetModuleHandleA
lstrlenA
VirtualAlloc
GetModuleHandleW
GetVersion
VirtualFree
IsDebuggerPresent
GetOEMCP
GetCommandLineW
GetCurrentProcessId
GetCurrentThread
DeleteFileW
QueryPerformanceCounter
GetCurrentThreadId
GlobalFindAtomA
DeleteFileA
GetDriveTypeA
GetCommandLineA
GetTickCount
GlobalFindAtomW
gdi32
PatBlt
GetTextMetricsA
SaveDC
DeleteDC
SetTextColor
SetTextAlign
LineTo
RestoreDC
SelectPalette
CreateFontIndirectA
GetStockObject
GetObjectA
CreatePen
SetMapMode
RectVisible
GetDeviceCaps
GetPixel
DeleteObject
CreatePalette
CreateCompatibleDC
GetClipBox
SetStretchBltMode
SelectObject
CreateSolidBrush
user32
GetDC
GetDesktopWindow
CharNextA
GetSystemMetrics
TranslateMessage
GetParent
glu32
gluNurbsCallback
Sections
.text Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Lus. Tqg Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Baro. Gb Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 101KB - Virtual size: 101KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ