Static task
static1
Behavioral task
behavioral1
Sample
52dcfa599eb0853d3fc96a6582a4cf6a_JaffaCakes118.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
52dcfa599eb0853d3fc96a6582a4cf6a_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
52dcfa599eb0853d3fc96a6582a4cf6a_JaffaCakes118
-
Size
166KB
-
MD5
52dcfa599eb0853d3fc96a6582a4cf6a
-
SHA1
e457ab95d9c41706fa2959505f1252e251ed8bae
-
SHA256
7abeb32aff5a76fc6bca280ec41fecd4d030b2a8e303c51971ccc10596850364
-
SHA512
b18745178f0238dffa99436be3f8d48d72db8f57283465f91688b0fc5e3edf8a48d927af527b7c030cc011c0268fdac60e7591d41ff69e7212725a90478bb938
-
SSDEEP
3072:ppmX0Zr2L48AY6f1mBty5xwzcN1mAYTijnQvnpEmh:f20Ng49l9mBtfc2AYyc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 52dcfa599eb0853d3fc96a6582a4cf6a_JaffaCakes118
Files
-
52dcfa599eb0853d3fc96a6582a4cf6a_JaffaCakes118.exe windows:4 windows x86 arch:x86
77e8ff767ab6836d9cc42751a6b88580
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
IsDebuggerPresent
GetWindowsDirectoryA
GetCommandLineA
GetUserDefaultLangID
GetProcessHeap
GetTickCount
lstrcmpiW
GetOEMCP
GetConsoleOutputCP
DeleteFileW
lstrcmpiA
GetCurrentThread
GlobalFindAtomW
lstrlenW
GetThreadLocale
MulDiv
GetCurrentProcessId
lstrcmpA
SetCurrentDirectoryA
RemoveDirectoryA
VirtualAlloc
GetVersion
GetCurrentProcess
GetACP
VirtualFree
GetModuleHandleA
GetDriveTypeA
GlobalFindAtomA
GetModuleHandleW
DeleteFileA
GetCommandLineW
GetStartupInfoA
CopyFileA
GetCurrentThreadId
lstrlenA
QueryPerformanceCounter
user32
GetDesktopWindow
TranslateMessage
CharNextA
GetDC
GetSystemMetrics
GetParent
gdi32
PatBlt
GetPixel
CreatePalette
RestoreDC
SetTextAlign
SetMapMode
SetStretchBltMode
RectVisible
GetObjectA
GetDeviceCaps
GetClipBox
SetTextColor
CreateSolidBrush
SelectObject
CreateCompatibleDC
GetTextMetricsA
CreateFontIndirectA
DeleteObject
SaveDC
GetStockObject
LineTo
CreatePen
DeleteDC
SelectPalette
glu32
gluNurbsCallback
Sections
.text Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Pqpmfi X Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 26KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Gijum Sp Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 98KB - Virtual size: 98KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ