Static task
static1
Behavioral task
behavioral1
Sample
eb639fec5df885c9bd9fa96c8b598857_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
eb639fec5df885c9bd9fa96c8b598857_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
eb639fec5df885c9bd9fa96c8b598857_JaffaCakes118
-
Size
53KB
-
MD5
eb639fec5df885c9bd9fa96c8b598857
-
SHA1
27f435ef8b7eb6aea106516f5dc6e5f62fbc530f
-
SHA256
4abf4860ae0a85482c2ca76d96cf1125ce883f91d98e54571f3aff2eb78045f0
-
SHA512
9b8c56e24de8110177c9e974ecab4ddb89b147fbb277caa68799b8a15cae6d5a94c5caf926f81754794f5137818e457f04013f353483e36c1ffcbe552e186eee
-
SSDEEP
768:f49HeEf0i1K9gU52fXFcXf6bpLSdar4ik7hQE1gJdyxoqtG/jKY7lx6wv:fLEX1Kv2PYybRSdaNk7hQcoTlj77fh
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource eb639fec5df885c9bd9fa96c8b598857_JaffaCakes118
Files
-
eb639fec5df885c9bd9fa96c8b598857_JaffaCakes118.exe windows:4 windows x86 arch:x86
7c7d9f939783c788a46cdf72b8716a45
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrcpyA
lstrcmpiA
CloseHandle
WaitForSingleObject
ResumeThread
LoadLibraryA
GetThreadContext
WriteProcessMemory
GetProcAddress
GetModuleHandleA
VirtualAllocEx
lstrlenA
GetExitCodeThread
VirtualProtect
VirtualAlloc
VirtualFree
GetExitCodeProcess
TerminateProcess
CreateProcessA
LockResource
LoadResource
FindResourceA
GetCurrentProcess
WinExec
SetFileAttributesA
WriteFile
ReadFile
CreateFileA
lstrcatA
GetSystemDirectoryA
Sleep
CreateThread
GetModuleFileNameA
SizeofResource
SetFilePointer
GetVersionExA
GetSystemTime
GetFileSize
GetStartupInfoA
user32
FindWindowA
PostMessageA
SendMessageA
wsprintfA
SetWindowPos
GetWindow
msvcrt
_controlfp
_except_handler3
__set_app_type
??2@YAPAXI@Z
??3@YAXPAX@Z
memset
memmove
strstr
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
Sections
.text Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 33KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ