Static task
static1
Behavioral task
behavioral1
Sample
f009730c40cc0a80e7e5d177c4afa020_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f009730c40cc0a80e7e5d177c4afa020_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f009730c40cc0a80e7e5d177c4afa020_JaffaCakes118
-
Size
358KB
-
MD5
f009730c40cc0a80e7e5d177c4afa020
-
SHA1
5f3361c76371b2981309423aa31e9cc8d6fcdbb3
-
SHA256
a3d04b0da2e2f4b0a75dcb1853d03f1528c6cf8b74ab821baf92c09df9c8c096
-
SHA512
bb08e1a5b34de059c3648437fbaf27f8d0da1143d5c3a11bdc055db3b746d6af41002e92978f882176bfa07477083a3fcd2892e9804fdfd3db77312bfa1b3d25
-
SSDEEP
3072:7sHaRsJZZZHpeBCsvDrGPd3o+223sJn0xveYt4ry+:UMkZfwFvuFqws+e+4ry+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f009730c40cc0a80e7e5d177c4afa020_JaffaCakes118
Files
-
f009730c40cc0a80e7e5d177c4afa020_JaffaCakes118.exe windows:4 windows x86 arch:x86
ee83c5c79d789b3f749f632cd0696a8b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
user32
GetKeyboardType
advapi32
RegQueryValueExA
oleaut32
SysFreeString
version
VerQueryValueA
urlmon
UrlMkGetSessionOption
shell32
SHGetSpecialFolderLocation
wsock32
WSACleanup
ntdll
RtlGetNtVersionNumbers
rpcrt4
UuidCreateSequential
Sections
CODE Size: 118KB - Virtual size: 356KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE