Static task
static1
Behavioral task
behavioral1
Sample
f143b63b38df12382bb3a0f709d3ba49_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f143b63b38df12382bb3a0f709d3ba49_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
f143b63b38df12382bb3a0f709d3ba49_JaffaCakes118
-
Size
63KB
-
MD5
f143b63b38df12382bb3a0f709d3ba49
-
SHA1
c248289afebae193c708b7d7efdc0e57d41372d2
-
SHA256
7cd19640008cfb4f9cd9c70c5e65cdc7bc8f6eb755c90992e476403071176dbc
-
SHA512
916f4927b80197d8154adf1cfb6635e0afc572d134b36a76a2cdcf23f69a1df8f85dc96a2f8e667f726232d29b088e6c1d439f09e05d239adbf715f7cf06ae0d
-
SSDEEP
1536:AuWCGWnWPq4qoSR1YSqRFnxMOOINcHn6g1tDvrbwlGKP9vIcgT:AuwWQqd1YhRBLsnd73wlJVQ5T
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f143b63b38df12382bb3a0f709d3ba49_JaffaCakes118
Files
-
f143b63b38df12382bb3a0f709d3ba49_JaffaCakes118.exe windows:4 windows x86 arch:x86
b1121c4edce10e6f04ed8d976a1d7e98
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetVersion
GetCurrentThreadId
GetThreadLocale
GetStartupInfoA
GetModuleFileNameA
GetLocaleInfoA
GetLastError
GetCommandLineA
FreeLibrary
ExitProcess
WriteFile
UnhandledExceptionFilter
SetFilePointer
SetEndOfFile
RtlUnwind
ReadFile
RaiseException
GetStdHandle
GetFileSize
GetFileType
CreateFileA
CloseHandle
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleA
WinExec
GetTempPathA
DeleteFileA
CopyFileA
user32
GetKeyboardType
MessageBoxA
CharNextA
advapi32
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
Sections
CODE Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DATA Size: 512B - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 1KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 8B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 900B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
FCryptor Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ