Static task
static1
Behavioral task
behavioral1
Sample
5549f1bd5e373fe0ffeaba6c99e833e3_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
5549f1bd5e373fe0ffeaba6c99e833e3_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
5549f1bd5e373fe0ffeaba6c99e833e3_JaffaCakes118
-
Size
526KB
-
MD5
5549f1bd5e373fe0ffeaba6c99e833e3
-
SHA1
7b950d9feb95c163e1946c2366eed7b24fb94648
-
SHA256
0a3ba12d5518abbb9b18f083d5bdbb916b2a05bd5467aa8566795376164c9492
-
SHA512
cd0b8a190536b70609a6fd54c36bbff469a5191b57045569ffb0518483a9df0fee7cc7973e8e1a80c66fb3addc817d2ffc776527aef6d7a01a5bbea23d302b8d
-
SSDEEP
12288:WTqoGjxzvR4VaT6iHDWfXkfN7MP4Mn9Yh6fGrREJRNDUTFZwP30gGe10mm9:V0HHSN82SR+TFZwMg/0p9
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5549f1bd5e373fe0ffeaba6c99e833e3_JaffaCakes118
Files
-
5549f1bd5e373fe0ffeaba6c99e833e3_JaffaCakes118.exe windows:4 windows x86 arch:x86
089c2a75195bf76c313b3acd871137d2
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
comdlg32
PrintDlgA
FindTextA
GetSaveFileNameA
ReplaceTextA
GetSaveFileNameW
FindTextW
PageSetupDlgA
GetFileTitleA
shell32
ExtractIconExA
SHGetNewLinkInfo
ShellExecuteW
SHGetInstanceExplorer
DragQueryFileA
SHLoadInProc
SheChangeDirA
SHFileOperation
RealShellExecuteExA
SHGetSpecialFolderPathA
SHQueryRecycleBinA
ExtractIconExW
SHUpdateRecycleBinIcon
SHGetSpecialFolderLocation
SHFormatDrive
SHEmptyRecycleBinW
DragFinish
ShellExecuteEx
DuplicateIcon
ExtractAssociatedIconA
wininet
InternetGetCookieW
IsUrlCacheEntryExpiredW
InternetCrackUrlA
SetUrlCacheGroupAttributeW
FtpSetCurrentDirectoryA
GetUrlCacheHeaderData
HttpSendRequestExW
InternetSetCookieA
FindFirstUrlCacheContainerA
CreateUrlCacheContainerW
RetrieveUrlCacheEntryFileA
FtpDeleteFileA
InternetConfirmZoneCrossing
InternetAutodialHangup
InternetGetLastResponseInfoA
gdi32
CreateFontIndirectW
RemoveFontResourceW
SetSystemPaletteUse
SetTextJustification
GetTextExtentPointW
GetCurrentPositionEx
CreateFontA
ScaleViewportExtEx
GetRegionData
RectVisible
CreateFontW
GetOutlineTextMetricsW
SetRectRgn
GetNearestPaletteIndex
GetEnhMetaFileBits
SetDIBitsToDevice
CreatePatternBrush
GetFontData
PolyDraw
CancelDC
kernel32
GetModuleHandleA
GetLocaleInfoW
GetEnvironmentStrings
TlsSetValue
UnhandledExceptionFilter
RtlUnwind
GetTimeZoneInformation
FreeLibrary
SetHandleCount
GetCurrentThreadId
GetProcAddress
HeapSize
DeleteCriticalSection
HeapCreate
CreateDirectoryW
GetStdHandle
CreateMailslotW
GetFileType
GetCurrentProcess
InterlockedExchange
GetStringTypeW
IsDebuggerPresent
VirtualProtectEx
WideCharToMultiByte
EnumResourceNamesW
LeaveCriticalSection
TlsGetValue
CompareStringA
WriteFile
TlsAlloc
EnumSystemLocalesA
ExitProcess
HeapAlloc
LocalHandle
GetACP
InterlockedDecrement
GetCurrentProcessId
GetDateFormatA
InterlockedExchangeAdd
QueryPerformanceCounter
SetUnhandledExceptionFilter
GetOEMCP
MultiByteToWideChar
GetCurrentThread
GetTimeFormatA
SetConsoleCtrlHandler
FreeEnvironmentStringsA
LCMapStringW
TerminateProcess
InitializeCriticalSection
GetEnvironmentStringsW
GetVersionExA
TlsFree
GetLocaleInfoA
GetStringTypeA
VirtualQuery
LoadLibraryA
EnterCriticalSection
GetProcessHeap
GetStartupInfoA
IsValidCodePage
HeapDestroy
HeapReAlloc
FreeEnvironmentStringsW
lstrcpy
lstrcpynA
VirtualFree
UnlockFile
SetEnvironmentVariableA
GetSystemTimeAsFileTime
HeapFree
SetLastError
WaitForSingleObjectEx
GetTickCount
GetModuleFileNameA
GetUserDefaultLCID
LCMapStringA
LocalCompact
GetCommandLineA
Sleep
InterlockedIncrement
IsValidLocale
CompareStringW
VirtualAlloc
GetCPInfo
GetLastError
advapi32
RegOpenKeyExA
RegQueryMultipleValuesW
CryptImportKey
CryptExportKey
LookupAccountSidW
InitiateSystemShutdownW
RegLoadKeyW
Sections
.text Size: 202KB - Virtual size: 201KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 313KB - Virtual size: 313KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ