Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_aee3546eadfad7f30f56dc3acee85be2.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_aee3546eadfad7f30f56dc3acee85be2.exe
Resource
win10v2004-20250129-en
General
-
Target
JaffaCakes118_aee3546eadfad7f30f56dc3acee85be2
-
Size
260KB
-
MD5
aee3546eadfad7f30f56dc3acee85be2
-
SHA1
9c43a9a9920eafdf5e02aa53b9d220e130666791
-
SHA256
e71337f71b7475495737aa4bb3a17a5273ca217eb3f505468ff1d246dcfb07a2
-
SHA512
db0bd8861cb0091497d64639e991bc2a58360527cf473836a67849c4057663ec3c1d73caf1a51df0401758cf033885cf0849bab8feead249f536534b88cfc46d
-
SSDEEP
6144:HFAqgNMrMNnHGUS0mATGBqxwO54kBzPpSC5T0i8S:lUNKMQUzSwh5bBzseT0m
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_aee3546eadfad7f30f56dc3acee85be2
Files
-
JaffaCakes118_aee3546eadfad7f30f56dc3acee85be2.exe windows:4 windows x86 arch:x86
b445b15e50823e4ff2dc442d1004381b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleW
MulDiv
CreateEventW
SetErrorMode
ExpandEnvironmentStringsA
GetCurrentThreadId
IsDebuggerPresent
SetUnhandledExceptionFilter
MoveFileW
WaitForSingleObject
GetTimeFormatW
CreateMutexW
FileTimeToSystemTime
CompareFileTime
GetLocalTime
GetVolumeInformationW
LocalAlloc
LocalFree
GetDateFormatW
OpenEventW
GetTempPathW
CreateDirectoryW
RemoveDirectoryW
FreeLibrary
GetWindowsDirectoryW
GetSystemDirectoryW
GetProcAddress
user32
GetForegroundWindow
GetActiveWindow
SetCapture
SetWindowLongW
GetIconInfo
LoadCursorW
SetCursor
GetFocus
CopyRect
GetSystemMetrics
DestroyIcon
IsWindow
InvalidateRect
SendMessageW
GetSysColor
LoadIconW
LoadImageW
MessageBoxW
EnableWindow
gdi32
CreatePalette
CreateCompatibleDC
CreatePen
GetStockObject
CreateFontIndirectW
CreateSolidBrush
DeleteObject
CreatePatternBrush
advapi32
RevertToSelf
RegOpenKeyExA
RegQueryValueExA
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
RegSetValueExW
RegCloseKey
ImpersonateSelf
OpenThreadToken
OpenProcessToken
AllocateAndInitializeSid
InitializeSecurityDescriptor
GetLengthSid
InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
IsValidSecurityDescriptor
AccessCheck
FreeSid
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
shell32
ShellExecuteW
usp10
UspFreeMem
ScriptXtoCP
ScriptString_pcOutChars
ScriptShape
iprtrmgr
MapInterfaceToAdapter
Sections
.text Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.c Size: 2KB - Virtual size: 542KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.CxMAKg Size: 3KB - Virtual size: 660KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.yOruq Size: 1KB - Virtual size: 153KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.zgefqi Size: 78KB - Virtual size: 133KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.H Size: 3KB - Virtual size: 321KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 7KB - Virtual size: 270KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.hwA Size: 134KB - Virtual size: 164KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bfm Size: 2KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ