Static task
static1
Behavioral task
behavioral1
Sample
cab485f42e842dc2bacea0a6d7688e6c_JaffaCakes118.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
cab485f42e842dc2bacea0a6d7688e6c_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
cab485f42e842dc2bacea0a6d7688e6c_JaffaCakes118
-
Size
340KB
-
MD5
cab485f42e842dc2bacea0a6d7688e6c
-
SHA1
13f6796312fc00141756c9c054b300cbe395ae2e
-
SHA256
474b715681f72984fd5f2a2698e193084a2d2cf71c66931f0cc21d145e66f8c5
-
SHA512
c23a8f65f1ce62d010bde605f30ff74154ba6e0da20a6ee70faa79e180d0e307a24b1d8300d4b53393bef0ef2484c65b62da1c5304f07daa174c1c25f3da3726
-
SSDEEP
6144:TUjcXma4WgQ/hWCKiFpaub1VUTJrvTCMXa+r3A6tpE32M+uPrPVJqW/Q4x3IpRFb:TUwX7CQcxub1wJBM6tLRuPrtJpB3Ia
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cab485f42e842dc2bacea0a6d7688e6c_JaffaCakes118
Files
-
cab485f42e842dc2bacea0a6d7688e6c_JaffaCakes118.exe windows:4 windows x86 arch:x86
c2086ed47b2eb77333f17b3179938391
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
NotifyBootConfigStatus
GetTrusteeFormA
BuildTrusteeWithNameA
GetTrusteeTypeA
BuildImpersonateTrusteeA
SetNamedSecurityInfoA
CreateProcessAsUserA
CreateServiceA
gdi32
GetPolyFillMode
GetBitmapBits
PlayEnhMetaFile
CopyEnhMetaFileW
CreateICW
GetTextMetricsA
OffsetRgn
GetTextExtentPointA
GetNearestPaletteIndex
CopyEnhMetaFileA
GetWinMetaFileBits
GetEnhMetaFileHeader
CreateRectRgn
SetPixel
Polygon
StrokePath
EndPath
PolyBezierTo
GetObjectType
GetTextExtentPoint32W
GetEnhMetaFilePaletteEntries
EnumFontFamiliesA
GetWindowOrgEx
SetViewportExtEx
Chord
GetGlyphOutlineW
UpdateColors
Ellipse
PtVisible
GetObjectA
GetGlyphOutlineA
OffsetWindowOrgEx
AbortDoc
IntersectClipRect
GetTextColor
GetClipRgn
OffsetClipRgn
SwapBuffers
CreatePenIndirect
LPtoDP
CreateFontIndirectA
SetTextCharacterExtra
ExtSelectClipRgn
ExtCreateRegion
GetROP2
SetViewportOrgEx
StretchBlt
GetTextExtentPoint32A
EnumFontFamiliesExW
GetCharABCWidthsW
SetColorAdjustment
GetFontData
EqualRgn
GetKerningPairsA
CreateBitmap
SetBkColor
RectVisible
ScaleWindowExtEx
GetDIBColorTable
CombineRgn
DPtoLP
MoveToEx
PatBlt
SetPixelFormat
OffsetViewportOrgEx
ExtEscape
SetBkMode
SetPolyFillMode
StartPage
GetDeviceCaps
Polyline
CreateFontA
PlayEnhMetaFileRecord
SetWorldTransform
GetRgnBox
CreateDIBPatternBrushPt
ResizePalette
SetROP2
GetClipBox
CloseEnhMetaFile
CreateFontIndirectW
CreatePen
DeleteObject
ExtCreatePen
CreateCompatibleDC
Arc
StartDocA
GetTextCharsetInfo
GetSystemPaletteEntries
SetTextAlign
EndDoc
SaveDC
CreateDCW
GetMapMode
GetEnhMetaFileBits
CreateFontW
GetCharWidthA
GetStockObject
BitBlt
SetTextColor
ExtTextOutA
DeleteDC
DeleteEnhMetaFile
Pie
CreateSolidBrush
SetPixelV
GdiFlush
CreateCompatibleBitmap
CreateRoundRectRgn
FillRgn
RealizePalette
Rectangle
EnumMetaFile
GetBrushOrgEx
SelectPalette
EnumFontsA
oleaut32
VARIANT_UserFree
VarCat
user32
SendMessageA
CreateIconFromResource
mpr
WNetAddConnection2A
WNetCancelConnectionA
msvcrt
__dllonexit
floor
ldexp
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_onexit
tanh
_winminor
_ftol
_acmdln
version
VerInstallFileA
VerQueryValueA
GetFileVersionInfoSizeW
VerInstallFileW
VerQueryValueW
mfc42
ord1576
ord1089
ord561
ord3738
ord4424
ord1053
ord4080
ord3079
ord3825
ord3831
ord3830
ord1069
ord2976
ord3081
ord2985
ord3262
ord1017
ord4465
ord3259
ord1003
ord2982
ord1018
ord5714
ord1091
ord5307
ord4698
ord1033
ord2725
ord815
ord6375
ord4486
ord2554
ord1060
ord5731
ord3922
ord1168
ord1077
ord2396
ord3346
ord1090
ord5302
Sections
.text Size: 220KB - Virtual size: 218KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 56KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 40KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ