Static task
static1
Behavioral task
behavioral1
Sample
edcc48483618797751865fa9c912cc98_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
edcc48483618797751865fa9c912cc98_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
edcc48483618797751865fa9c912cc98_JaffaCakes118
-
Size
94KB
-
MD5
edcc48483618797751865fa9c912cc98
-
SHA1
ea9a76c5ea44f670d3a5ef0fce862c0a9182c809
-
SHA256
6bed3a995087a04512fcd0083bf79c362dc2c0104affc7eb03570c6f0d6e4da2
-
SHA512
5f56a070102e92d3d7b2da94a04cf65794ffce4aac4960edbb40618e1613e773fd3b43a7cfc499c951573e868f8c6231d3b915d19e75c19a3976edd61527bf91
-
SSDEEP
1536:xt9DlwhCCdMcWX6nHapBM/r/Ou61vGBUuwBECTc8YaEJwZK4/83ZoMOALF6SSf:5DlwhjdMl6nHb/LOu6tGB2EUhZEXtpx+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource edcc48483618797751865fa9c912cc98_JaffaCakes118
Files
-
edcc48483618797751865fa9c912cc98_JaffaCakes118.exe windows:4 windows x86 arch:x86
c74d80bdbe9c13c92589e0c1c447910b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LCMapStringA
FindVolumeClose
ExitVDM
Toolhelp32ReadProcessMemory
MultiByteToWideChar
CreateToolhelp32Snapshot
GetGeoInfoA
OpenEventA
GetNamedPipeHandleStateW
SetFileAttributesA
IsValidLocale
Sections
.text Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
rdata Size: - Virtual size: 64KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 42KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.krdata Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE