Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_544b8707f74762c11a5f67af5b78e0bd.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_544b8707f74762c11a5f67af5b78e0bd.exe
Resource
win10v2004-20250129-en
General
-
Target
JaffaCakes118_544b8707f74762c11a5f67af5b78e0bd
-
Size
279KB
-
MD5
544b8707f74762c11a5f67af5b78e0bd
-
SHA1
87978cedf7f4c72f1b6c2255c29633a2d34da518
-
SHA256
4c5412efbda7545014cc5d43bba16772c41d1df87c0ee075c6ab3f88837477e7
-
SHA512
44c7a65990e95e24f7ef9354f65601d3d634d938197bd5e85ff2562e6da834c78256de9f0b0a804f4551e5b161d511247e0d9aedc27d2ed21cc0bcceb8dd550b
-
SSDEEP
6144:2RASCIYJXQU/qaNr1gyL0bwPcJSJJ+WTO:2RKIgX//qmr1gTbsJB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_544b8707f74762c11a5f67af5b78e0bd
Files
-
JaffaCakes118_544b8707f74762c11a5f67af5b78e0bd.exe windows:4 windows x86 arch:x86
ad4b7ed52d46c6255870e4dae4b321ee
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
comctl32
ImageList_DragMove
ImageList_DragLeave
ImageList_DragEnter
newdev
UpdateDriverForPlugAndPlayDevicesW
setupapi
CM_Get_Sibling
CMP_WaitNoPendingInstallEvents
SetupDiGetDeviceRegistryPropertyW
CM_Get_DevNode_Status
iphlpapi
GetIpAddrTable
shlwapi
StrCmpNIA
StrStrA
shell32
SHGetFolderPathW
kernel32
GetProcessHeap
CreateSemaphoreA
GetLastError
LockResource
CreateFileW
LoadResource
ResetEvent
FreeLibrary
AddAtomW
WideCharToMultiByte
WaitForMultipleObjects
lstrlenA
InterlockedIncrement
SetThreadPriority
VirtualFree
CreateMutexA
LoadLibraryW
VirtualAlloc
GetCurrentProcessId
FindResourceA
GetSystemInfo
LoadLibraryA
EnterCriticalSection
GetTickCount
EnumResourceLanguagesW
GlobalAlloc
GetThreadPriority
GetModuleFileNameW
ReleaseMutex
ReleaseSemaphore
LeaveCriticalSection
HeapFree
MultiByteToWideChar
GetGeoInfoW
TerminateThread
IsBadReadPtr
Sleep
InterlockedDecrement
GetModuleFileNameA
GetSystemTime
QueryPerformanceCounter
IsBadWritePtr
GetProcAddress
GetExitCodeThread
GetCurrentThreadId
DisableThreadLibraryCalls
GetCurrentThread
ExitProcess
Sections
.text Size: 141KB - Virtual size: 276KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 135KB - Virtual size: 134KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ