Static task
static1
Behavioral task
behavioral1
Sample
eaef6688a799ee9cae2f9db63acffd1e_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
eaef6688a799ee9cae2f9db63acffd1e_JaffaCakes118
-
Size
238KB
-
MD5
eaef6688a799ee9cae2f9db63acffd1e
-
SHA1
2f5fbb89561fdb80f7c6e0138abb2c8280dfcdad
-
SHA256
fae28d93ca4e85b844727582f2302afba8fc22e39ff9c02e52b9def1563a92a6
-
SHA512
321e386a58a3b779578b5c4ab69b509d7a1146c8b8860e1d60e10911f42f4ed2cbbb2f19ea3d513bef6c20c622604a7e8345be3c63e49b613981585148372db0
-
SSDEEP
6144:ds5XwKv5V8r9VBUShIsn2Lq25kOaB4YXd9K:65XJvO1USKLqSalXnK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource eaef6688a799ee9cae2f9db63acffd1e_JaffaCakes118
Files
-
eaef6688a799ee9cae2f9db63acffd1e_JaffaCakes118.exe windows:4 windows x86 arch:x86
498f1c3b1cfdd1f6431d4d43ce7429d6
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
MessageBoxA
GetKeyboardType
PeekMessageA
kernel32
GetModuleFileNameA
GetEnvironmentVariableA
ExitProcess
FormatMessageA
GetLastError
SetLastError
GetProcAddress
VirtualProtect
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
GetModuleFileNameW
GetVersionExA
VirtualFree
VirtualAlloc
GlobalAlloc
SetFilePointer
ReadFile
CreateFileA
DeleteCriticalSection
TlsSetValue
WriteFile
Sleep
advapi32
RegQueryValueExA
oleaut32
SysFreeString
SafeArrayPtrOfIndex
Sections
.text Size: 20KB - Virtual size: 204KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE