Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_d026b398fbae86ca6311b7184d90717b.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_d026b398fbae86ca6311b7184d90717b.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_d026b398fbae86ca6311b7184d90717b
-
Size
215KB
-
MD5
d026b398fbae86ca6311b7184d90717b
-
SHA1
2c35a40f2dbaf6baa269a0c17126c96b344bc40f
-
SHA256
4ff16b1f4a8403d52df8ba651cb55a0283e09c048df1d3ddd4019e60443d8ba4
-
SHA512
af68aa612ae04dce41694eed02afaf94ab6bed0822bfbbba501fdf445bfda4cc9609bf72c88105dfaf6a8ab0d61a7dfdbdc53cb4972adf8d3318b163f43f3a45
-
SSDEEP
6144:eholGHjQ6Z07otxG3ye/8VO8baWQGBSnLx3c3BxlRzyuc0:eeGDQ6uoOl/8VO8bx7Woya
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_d026b398fbae86ca6311b7184d90717b
Files
-
JaffaCakes118_d026b398fbae86ca6311b7184d90717b.exe windows:4 windows x86 arch:x86
8b46375fa1e6c56675e3cc4330b9a97d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_DEBUG_STRIPPED
Imports
user32
RealGetWindowClass
LoadImageW
IsZoomed
IsWindow
SetWindowPlacement
LoadIconW
GetParent
SetWindowPos
IsIconic
MapVirtualKeyW
DestroyWindow
GetWindowPlacement
ShowWindow
GetSystemMetrics
UpdateWindow
SetForegroundWindow
setupapi
SetupDiGetDeviceRegistryPropertyW
CMP_WaitNoPendingInstallEvents
CM_Get_DevNode_Status
kernel32
WaitForSingleObject
CreateFiberEx
GetSystemTimeAsFileTime
GetLocaleInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetModuleHandleW
CloseHandle
LoadLibraryW
TlsFree
ReleaseSemaphore
GetTickCount
TerminateProcess
GetProcAddress
GetCurrentProcess
DeleteFileW
GetProcessHeap
EnumResourceNamesA
LoadLibraryA
InterlockedExchange
FoldStringW
RaiseException
InterlockedCompareExchange
GetLastError
FlushFileBuffers
QueryPerformanceCounter
CreateSemaphoreW
LocalAlloc
GetCurrentProcessId
TlsGetValue
FreeLibrary
IsDebuggerPresent
GetCurrentThreadId
TlsAlloc
VirtualProtect
GetStartupInfoA
GetCommandLineW
Sleep
GetModuleFileNameW
msimg32
AlphaBlend
Sections
.text Size: 192KB - Virtual size: 191KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ