?_DestroyCaret@@YGPAXKEPAI@Z
Static task
static1
Behavioral task
behavioral1
Sample
914b01b7524386733a593c05a17f5876_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
914b01b7524386733a593c05a17f5876_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
914b01b7524386733a593c05a17f5876_JaffaCakes118
-
Size
147KB
-
MD5
914b01b7524386733a593c05a17f5876
-
SHA1
1bfbd5ac776ba6794208f341735d0239409aa44d
-
SHA256
da4615efc976edcec0ce6a1dc8308dc2977a68b7cf8bcc2c3ff0beee0f134ea1
-
SHA512
54018e7c2df4173afe4d240aafeae139b8434170a5a76eb06f7d91075fe2a7db72751d96fb5471f6af34b563f137281fe2d9a6069842c72596341704e5d58334
-
SSDEEP
3072:u1D7gtFBYw3uDTWUU1LX57qcCXPYfaRDRCAzilS:uZUYoUcwdgidl
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 914b01b7524386733a593c05a17f5876_JaffaCakes118
Files
-
914b01b7524386733a593c05a17f5876_JaffaCakes118.exe windows:5 windows x86 arch:x86
cdee2c2b07ebb0d8e63b3c72d0e7ed6b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
StrRChrIA
StrCpyW
StrCmpNIW
PathCanonicalizeW
ord158
PathFindNextComponentW
ChrCmpIW
kernel32
LoadLibraryExW
GetCommConfig
CopyFileW
CreateFileMappingW
FileTimeToDosDateTime
GetCommProperties
ClearCommBreak
OpenEventW
AssignProcessToJobObject
GetLogicalDriveStringsA
GetTapeStatus
GetDiskFreeSpaceW
GlobalHandle
WaitCommEvent
lstrcatW
GetModuleFileNameA
OpenWaitableTimerA
CreateMailslotW
CancelDeviceWakeupRequest
user32
CheckMenuRadioItem
SetPropA
GetWindowTextA
OpenInputDesktop
GetMenuStringW
ReplyMessage
ChangeMenuW
EnumDisplayMonitors
CallMsgFilterW
GetWindowContextHelpId
SendDlgItemMessageW
CreateIconFromResource
SendMessageCallbackW
GetCaretPos
ShowScrollBar
DestroyMenu
EnumDisplayDevicesA
GetKeyboardLayoutList
RegisterClassA
LoadCursorA
GetPropW
gdi32
PolyDraw
SelectObject
GetWinMetaFileBits
DeleteEnhMetaFile
UpdateColors
GetCurrentPositionEx
GetTextExtentPointW
CreatePalette
GdiFlush
CreateDIBPatternBrush
GetPixelFormat
PolyBezierTo
Exports
Exports
Sections
.text Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.icode Size: 1024B - Virtual size: 643B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 748B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.m_data Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.c_data Size: 512B - Virtual size: 60B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.n_data Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 128KB - Virtual size: 127KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 866B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ