Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_f987488ae2b6f7fb1393dda79553bb69.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_f987488ae2b6f7fb1393dda79553bb69.exe
Resource
win10v2004-20250211-en
General
-
Target
JaffaCakes118_f987488ae2b6f7fb1393dda79553bb69
-
Size
268KB
-
MD5
f987488ae2b6f7fb1393dda79553bb69
-
SHA1
220b058efeefb1258ff79060ef0c68b80d88bc5a
-
SHA256
72c83294b4b78ef1659d85fcf2c6501ccfe3379400b9bf9a12b0e3573fde9e6d
-
SHA512
ada0f2e7ea319379b6e0f898df83d997d96e8e78b38ca3b8e3d73d4a0354afdb109d26b787f95f90bace60be6f5c2f5bd4adc8ab5bf4774dfd0d9251d470317d
-
SSDEEP
6144:myFXbK4tDJQ9+kgdHtxtmVp6I1ZESMqvMjufIng:vpWeKVBZoLjufV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_f987488ae2b6f7fb1393dda79553bb69
Files
-
JaffaCakes118_f987488ae2b6f7fb1393dda79553bb69.exe windows:4 windows x86 arch:x86
bfa464a8ac5ae365fc3317eb8646efb6
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrlenW
GetModuleHandleW
lstrcpynW
lstrlenA
CreateDirectoryW
GetTempPathW
LocalAlloc
RemoveDirectoryW
LocalFree
OpenEventW
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
WaitForSingleObject
CreateEventW
FreeLibrary
ExpandEnvironmentStringsA
GetProcessHeap
GetProcAddress
user32
GetForegroundWindow
MoveWindow
IsWindow
GetTopWindow
OffsetRect
PostMessageW
SetWindowPos
SendMessageW
EnableWindow
gdi32
DeleteObject
CreatePatternBrush
CreateSolidBrush
SetMetaFileBitsEx
SetEnhMetaFileBits
CreateEllipticRgn
SetWinMetaFileBits
advapi32
AccessCheck
RegOpenKeyExA
RegQueryValueExA
OpenServiceW
StartServiceW
QueryServiceStatus
OpenSCManagerW
CloseServiceHandle
RegCreateKeyExW
RegDeleteValueW
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
GetLengthSid
IsValidSecurityDescriptor
FreeSid
RevertToSelf
OpenProcessToken
OpenThreadToken
SetSecurityDescriptorGroup
AddAccessAllowedAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
ImpersonateSelf
InitializeAcl
AllocateAndInitializeSid
SetSecurityDescriptorOwner
shell32
SHBrowseForFolderW
ShellExecuteW
usp10
UspFreeMem
ScriptGetFontProperties
ScriptCacheGetHeight
Sections
.text Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.fHZ Size: 3KB - Virtual size: 515KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vPO Size: 3KB - Virtual size: 180KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 2KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.YI Size: 2KB - Virtual size: 241KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tSu Size: 4KB - Virtual size: 785KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.es Size: 83KB - Virtual size: 124KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xoS Size: 1024B - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.RdQw Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 8KB - Virtual size: 110KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VjHqBi Size: 133KB - Virtual size: 140KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gqM Size: 3KB - Virtual size: 455KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ooc Size: 5KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ