Static task
static1
Behavioral task
behavioral1
Sample
52ac0ccf1458a479500c5f5d7fe4fdf9_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
52ac0ccf1458a479500c5f5d7fe4fdf9_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
52ac0ccf1458a479500c5f5d7fe4fdf9_JaffaCakes118
-
Size
148KB
-
MD5
52ac0ccf1458a479500c5f5d7fe4fdf9
-
SHA1
cf09c5d79e18b9ca5d1d4a892d94856938cbcae9
-
SHA256
b1eb8ffa9ba7be6c4296822278c40b485cc9ecb2f1d9e5cb459a38a56ba0ecf6
-
SHA512
8fd5f77b09598d8786cc655bcb29ecea52e19185775a59d5b194a57278b6e153737a01c5818b5dc4446c64e03d7106f11b3c8cb4301869c5f68c296caf85139c
-
SSDEEP
1536:lh1Tx3Sn0fH4wWf8Z92M5TJFoo6UsuPzNcQkHHAc5cUG94kS:lh1snyH4z8Z9Wbc6QkAc5cM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 52ac0ccf1458a479500c5f5d7fe4fdf9_JaffaCakes118
Files
-
52ac0ccf1458a479500c5f5d7fe4fdf9_JaffaCakes118.exe windows:4 windows x86 arch:x86
54374a66802a03b20cdae3e8afc167bf
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
OpenProcess
lstrcmpiA
lstrcmpA
RaiseException
InterlockedExchange
LocalAlloc
FlushFileBuffers
SetStdHandle
GetStringTypeW
GetStringTypeA
SetFilePointer
InterlockedIncrement
InterlockedDecrement
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
IsBadWritePtr
HeapReAlloc
VirtualAlloc
WriteFile
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentVariableA
CloseHandle
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
LCMapStringW
LCMapStringA
MultiByteToWideChar
WideCharToMultiByte
GetOEMCP
GetACP
GetCPInfo
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetLastError
TlsGetValue
SetLastError
TlsAlloc
TlsSetValue
GetCurrentThreadId
HeapAlloc
HeapFree
ExitProcess
GetVersion
GetCommandLineA
GetStartupInfoA
RtlUnwind
GetModuleHandleA
lstrcpyA
GetVersionExA
GetProcAddress
WritePrivateProfileStringA
lstrcatA
GetPrivateProfileStringA
GetPrivateProfileIntA
GetTickCount
FindNextFileA
FindFirstFileA
FindClose
FreeLibrary
LoadLibraryA
GetFileType
GetModuleFileNameA
user32
GetSystemMetrics
DestroyCursor
SetWindowPos
ShowWindow
IsDlgButtonChecked
GetDlgItemTextA
GetWindowRect
ReleaseDC
ReleaseCapture
GetWindowDC
InvalidateRect
RedrawWindow
WindowFromPoint
GetAncestor
SetDlgItemTextA
GetWindowTextA
SendDlgItemMessageA
SetCursorPos
SetCursor
SetCapture
GetWindowThreadProcessId
LoadImageA
LoadCursorA
RegisterClassExA
GetSysColorBrush
RegisterWindowMessageA
GetMessageA
TranslateMessage
DispatchMessageA
DestroyIcon
SystemParametersInfoA
KillTimer
GetForegroundWindow
IsIconic
EnumWindows
SetTimer
IsWindow
SetLayeredWindowAttributes
UpdateWindow
PostQuitMessage
DialogBoxParamA
LoadMenuA
GetSubMenu
SetMenuDefaultItem
EnableMenuItem
SetMenuItemInfoA
SetForegroundWindow
GetCursorPos
TrackPopupMenu
DestroyMenu
GetDoubleClickTime
IsZoomed
MoveWindow
DefWindowProcA
SetWindowTextA
PostMessageA
FindWindowA
GetWindowLongA
GetClassNameA
LoadStringA
MessageBoxA
GetDlgItem
SendMessageA
SetFocus
EnableWindow
EndDialog
GetParent
DestroyWindow
IsWindowVisible
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
CreateWindowExA
SetWindowLongA
UpdateLayeredWindow
GetDC
CallWindowProcA
gdi32
DeleteObject
SelectObject
GetStockObject
Rectangle
CreatePen
CreateDIBSection
CreateCompatibleDC
CreateSolidBrush
shell32
SHGetFileInfoA
Shell_NotifyIconA
comctl32
ImageList_Destroy
ImageList_Create
ImageList_Remove
ImageList_ReplaceIcon
ord17
PropertySheetA
comdlg32
ChooseColorA
Sections
.text Size: 64KB - Virtual size: 60KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 65KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 56KB - Virtual size: 55KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ