Static task
static1
Behavioral task
behavioral1
Sample
e83e96ceb74ccbd1b3a97f92b9f356c7_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e83e96ceb74ccbd1b3a97f92b9f356c7_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
e83e96ceb74ccbd1b3a97f92b9f356c7_JaffaCakes118
-
Size
24KB
-
MD5
e83e96ceb74ccbd1b3a97f92b9f356c7
-
SHA1
5a9d3b0ac70a6b2f5ee1cf88a1250291328300c0
-
SHA256
2d4584712a1a098e86fdb5aba67cfa75ba8e23a9fd61cb42af232167dfd558cc
-
SHA512
0505fa51059f435f98bcb665f39a10301134a2c7f9ae2e071c3fb86f1ad374489c9b10b79c63a4e522e8408acaeef84c3def0eed074e16d0381e317ae2b56ef2
-
SSDEEP
384:yL28jc7919Y5gvr21O4oBzUi9OKz/8oXK4vQj13n:ymaWzgOvxUi9OK78of813
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e83e96ceb74ccbd1b3a97f92b9f356c7_JaffaCakes118
Files
-
e83e96ceb74ccbd1b3a97f92b9f356c7_JaffaCakes118.exe windows:4 windows x86 arch:x86
30d93b61d010e8d41ea546922399300c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
DeviceIoControl
ReadFile
SizeofResource
LockResource
LoadResource
FindResourceA
GetModuleHandleA
GetFileAttributesA
GetLastError
GetProcAddress
GetFileSize
CreateFileA
VirtualUnlock
Sleep
SetThreadPriority
GetCurrentThread
VirtualLock
MapViewOfFile
SetProcessAffinityMask
GetProcessAffinityMask
GetCurrentProcess
SetFilePointer
WriteFile
CloseHandle
SetFileAttributesA
GetStartupInfoA
CreateProcessA
WaitForSingleObject
DeleteFileA
ExpandEnvironmentStringsA
CreateDirectoryA
LocalFree
user32
wsprintfA
advapi32
CloseServiceHandle
SetSecurityInfo
ControlService
DeleteService
OpenSCManagerA
CreateServiceA
OpenServiceA
StartServiceA
GetSecurityInfo
SetEntriesInAclA
ntdll
ZwOpenSection
RtlUnwind
_aullshr
_allmul
_chkstk
ZwClose
RtlInitUnicodeString
_stricmp
msvcrt
exit
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
malloc
free
_exit
_XcptFilter
_getch
_acmdln
__getmainargs
_initterm
Sections
.text Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 608B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ