Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_12c74ead4a53919171a5ef1f61b2101c.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_12c74ead4a53919171a5ef1f61b2101c.exe
Resource
win10v2004-20250217-en
General
-
Target
JaffaCakes118_12c74ead4a53919171a5ef1f61b2101c
-
Size
248KB
-
MD5
12c74ead4a53919171a5ef1f61b2101c
-
SHA1
daa97c0bd905f13b1518a3b2b13dd684cc40c6b5
-
SHA256
2798c59c3a2fdc39f58aace2b882449b73063cf01302701ba6d5dc0813afb1f6
-
SHA512
85d2e1719f0b89f298fd2fac22514e9320dbaf12173171d8da606dd26c8923b1ef511f92ab706e1b4282825e159dbc892e4ccb991b2097f7722186a3c9d51721
-
SSDEEP
6144:b9NfOPwve134F0LloHEcwFzXitv28YAZYI7uDVMi1qRTnbp:b9N2oG33mRwFrqvqH7ERTt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_12c74ead4a53919171a5ef1f61b2101c
Files
-
JaffaCakes118_12c74ead4a53919171a5ef1f61b2101c.exe windows:4 windows x86 arch:x86
442106497131d511d03c4c8c01158cd0
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ole32
CoCreateInstance
gdi32
CreatePen
GetDeviceCaps
CreateSolidBrush
advapi32
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegCreateKeyExA
user32
GetDoubleClickTime
SystemParametersInfoA
EqualRect
ReleaseDC
GetSystemMetrics
LoadCursorA
GetDC
IsCharAlphaNumericA
GetSysColor
CharNextW
oleaut32
VariantInit
RegisterTypeLi
SysStringByteLen
SysAllocString
UnRegisterTypeLi
SysFreeString
SysStringLen
SysAllocStringByteLen
SysAllocStringLen
VariantChangeType
VariantClear
VarBstrCat
VarBstrCmp
shlwapi
PathStripToRootW
PathRemoveFileSpecW
PathIsRelativeW
PathCanonicalizeW
PathIsURLW
PathRenameExtensionW
PathFileExistsW
kernel32
ReleaseMutex
EnterCriticalSection
SetUnhandledExceptionFilter
HeapDestroy
InitializeCriticalSectionAndSpinCount
LocalFree
CloseHandle
GetSystemTimeAsFileTime
IsDBCSLeadByte
DeleteFileW
FindResourceExW
lstrlenA
GetFullPathNameA
LeaveCriticalSection
IsDebuggerPresent
GetCurrentDirectoryW
GetModuleHandleW
FindFirstFileA
GetModuleHandleA
GetProcessHeap
lstrlenW
GetCurrentDirectoryA
GetUserDefaultLangID
GetFullPathNameW
LockResource
LocalAlloc
WaitForSingleObject
HeapSize
LoadResource
FindClose
HeapReAlloc
HeapFree
RaiseException
DeleteCriticalSection
UnhandledExceptionFilter
DeleteFileA
GetCurrentThreadId
CreateMutexA
FindResourceW
SizeofResource
CopyFileW
IsProcessorFeaturePresent
HeapAlloc
GetStartupInfoA
VirtualAllocEx
lstrcmpA
security
ExportSecurityContext
ImportSecurityContextW
ImportSecurityContextA
QuerySecurityPackageInfoA
ntlanui2
DllCanUnloadNow
Sections
.text Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 219KB - Virtual size: 221KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ