Static task
static1
Behavioral task
behavioral1
Sample
806ba78c270689dc8d04d63a74ac34d1_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
806ba78c270689dc8d04d63a74ac34d1_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
806ba78c270689dc8d04d63a74ac34d1_JaffaCakes118
-
Size
585KB
-
MD5
806ba78c270689dc8d04d63a74ac34d1
-
SHA1
5228a732d560d61947b383c90ea706284fda2a59
-
SHA256
5505414a77cb25c03133d651195921bfa30a193c12f7d176948897511c513a99
-
SHA512
61d223422011d80c4296fad361f034f9ca6d7f91721bb0eadbd6036bb1e2fc887e3c7091e4e646c851fd171647b7d508f270bfa7563de3971a7943d204468679
-
SSDEEP
3072:kaPa4q4hBSvcghvrJ5h4syGiLtvzgBOzgmo2v:kUqfvrjh4MitvzgAzB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 806ba78c270689dc8d04d63a74ac34d1_JaffaCakes118
Files
-
806ba78c270689dc8d04d63a74ac34d1_JaffaCakes118.exe windows:4 windows x86 arch:x86
639194a54a132cec9688e31b464a58e0
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetDiskFreeSpaceA
GetDateFormatW
CloseHandle
GetProcAddress
Process32Next
OpenProcess
CreateProcessA
OpenSemaphoreW
GetExitCodeProcess
GetCommState
DosDateTimeToFileTime
GetSystemDirectoryA
FreeResource
GetModuleFileNameA
Process32First
CreateRemoteThread
GetWindowsDirectoryA
GetModuleHandleA
LoadModule
ExitProcess
HeapDestroy
CopyFileW
LoadLibraryA
GetCurrentProcess
GetSystemTime
OpenMutexA
GetVersion
LockResource
GlobalFindAtomA
GetExitCodeThread
ReadProcessMemory
FindFirstFileW
GetPrivateProfileSectionNamesW
OutputDebugStringA
EnumResourceNamesA
WaitForSingleObject
CopyFileA
GlobalHandle
GetCurrentProcessId
WriteProcessMemory
IsValidLocale
CreateToolhelp32Snapshot
TerminateProcess
GetExitCodeProcess
FindFirstFileA
OpenThread
user32
CharUpperA
CheckRadioButton
DrawMenuBar
CharToOemA
DispatchMessageA
ShowWindow
CharLowerA
DefWindowProcA
CreateIcon
UpdateWindow
AllowSetForegroundWindow
RegisterClassExA
GetMessageA
EnumDisplaySettingsW
CreateWindowExA
TranslateMessage
CheckRadioButton
FlashWindowEx
advapi32
OpenEventLogW
GetSecurityDescriptorSacl
ReportEventA
GetServiceDisplayNameA
RegisterTraceGuidsA
CryptDestroyHash
RegCloseKey
GetEffectiveRightsFromAclW
GetSecurityDescriptorGroup
SetTokenInformation
GetSecurityDescriptorOwner
InitializeAcl
QueryServiceConfigA
GetAce
GetSecurityDescriptorLength
shell32
DuplicateIcon
SHFileOperation
Shell_NotifyIcon
ExtractIconEx
SheChangeDirA
DragQueryFile
ShellExecuteA
ExtractAssociatedIconA
gdi32
SetBrushOrgEx
ArcTo
EndDoc
CreateDIBSection
GetBitmapDimensionEx
GdiFlush
CreateBitmapIndirect
DeleteMetaFile
EnumObjects
Sections
.text Size: 116KB - Virtual size: 116KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 348KB - Virtual size: 348KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 108KB - Virtual size: 108KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.aspack Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: 4KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE