Static task
static1
Behavioral task
behavioral1
Sample
f2936798c97423e8463048159e939366_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f2936798c97423e8463048159e939366_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f2936798c97423e8463048159e939366_JaffaCakes118
-
Size
293KB
-
MD5
f2936798c97423e8463048159e939366
-
SHA1
2cc0493a4b8f1bf1328aeb9ed5e8fd0008dcb45c
-
SHA256
a4d04eb2385a9c033eb1ff2f0619742a6d3e6e6e53420949b01b9db8ec47760d
-
SHA512
da836b854d484671b88acba26c922dfd3018a189dbcf3e4f3dd8d1d2b5914140be15ba676eb5e9174f5d6e3d414b35ff51fb5cf65eb1770d328ab3f9039ebd4d
-
SSDEEP
6144:rKr5cYUN6JKwI+Q9nx03RNrcsUE/bqn6snt28j4+9dkuCli6qP:r2UjwF3NG6s1j4cWNlsP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f2936798c97423e8463048159e939366_JaffaCakes118
Files
-
f2936798c97423e8463048159e939366_JaffaCakes118.exe windows:4 windows x86 arch:x86
6c16af3f1adbf4617d1c5b744022b144
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryA
GetProcAddress
Heap32ListFirst
Module32First
VirtualProtect
CreateFileA
WriteFile
VirtualFree
Sleep
VirtualAlloc
Heap32First
user32
GetMessagePos
PostMessageA
wininet
InternetCloseHandle
FtpPutFileA
ole32
CoInitializeEx
OleInitialize
CoInitialize
advapi32
RegQueryValueA
RegQueryValueExA
RegEnumValueA
Sections
pQHMAlld Size: 31KB - Virtual size: 30KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
FRVcGBkN Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DXfFzsTj Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
RPgrnVsM Size: 258KB - Virtual size: 272KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE