Static task
static1
Behavioral task
behavioral1
Sample
ec8a8b8a7ab5c10189a19d97f022bb1d_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
ec8a8b8a7ab5c10189a19d97f022bb1d_JaffaCakes118.exe
Resource
win10v2004-20240319-en
General
-
Target
ec8a8b8a7ab5c10189a19d97f022bb1d_JaffaCakes118
-
Size
46KB
-
MD5
ec8a8b8a7ab5c10189a19d97f022bb1d
-
SHA1
6b1e43edac5ccb5dc36d20b29faca15b7d4281e0
-
SHA256
2b5ef013cedc2d220fe1929c59bb2910d18880057bfb90066f7fb57da150db88
-
SHA512
e0dd02bbb9a90145d256a505227c0c52a041e021cef48b26b666a548b40e25469b9f06de69409dd7114b30e18a19eeaf3dcc547ea97852cd6be7d0bbece9d03a
-
SSDEEP
768:QXKtTLqTELTrxzYfVb8iUz9qN3CYG/FzWai0d9MLlRpFYdwZejKqbHn7ra:CKFLqwbxMaz9QXCFiai0rwFnZemeHn7W
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ec8a8b8a7ab5c10189a19d97f022bb1d_JaffaCakes118
Files
-
ec8a8b8a7ab5c10189a19d97f022bb1d_JaffaCakes118.exe windows:5 windows x86 arch:x86
4a1b94b7410965a885168ee95b92d500
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegCloseKey
RegDeleteValueA
CryptCreateHash
RegQueryValueExA
DuplicateTokenEx
CryptGetHashParam
CryptReleaseContext
shlwapi
PathRemoveFileSpecW
wvnsprintfW
wvnsprintfA
StrCmpNIA
SHDeleteKeyA
StrStrW
StrCmpNIW
wnsprintfA
wnsprintfW
PathFindFileNameW
PathMatchSpecW
PathCombineW
PathFileExistsW
Sections
.cvwf Size: 36KB - Virtual size: 56KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.zet Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.foduz Size: 5KB - Virtual size: 72KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
RCryptor Size: 67B - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ