Static task
static1
Behavioral task
behavioral1
Sample
f3e53de53ebc4566f7d79127310bdefc_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f3e53de53ebc4566f7d79127310bdefc_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f3e53de53ebc4566f7d79127310bdefc_JaffaCakes118
-
Size
313KB
-
MD5
f3e53de53ebc4566f7d79127310bdefc
-
SHA1
4fc0637af0de74bff6e3ac8e617b7a4369c77252
-
SHA256
8127cd2e32c3a8e3684b1a711c7c811d4903aec5f121d7f5c5e5e0f8ae1db0a0
-
SHA512
bb38e7bf8691af76c2630fea564cc820ad7099e3f020fe64b8fd09bd9b29f756fa7fdbaf282bfca1dbbca5f911977083e257bcd100c2b9c30e10ca66726b1f51
-
SSDEEP
6144:MOK8nYZikIsTCi9wjCKOVPkJG9ytNIbIhlilE0qAMjpVb1vESXRWTeKmcxSK:VK8nVxsmiS17q+NIbNlVAV1R/cxSK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource f3e53de53ebc4566f7d79127310bdefc_JaffaCakes118
Files
-
f3e53de53ebc4566f7d79127310bdefc_JaffaCakes118.exe windows:4 windows x86 arch:x86
52ec9875ab647fe99a22d1c823ff3e94
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
OutputDebugStringA
Sleep
GetTickCount
VirtualProtect
VirtualQuery
WideCharToMultiByte
GetLastError
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
LoadLibraryA
GetProcAddress
RtlUnwind
HeapFree
HeapAlloc
ExitProcess
TerminateProcess
GetCurrentProcess
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
WriteFile
GetCPInfo
GetACP
GetOEMCP
GetStringTypeW
user32
MessageBoxA
msvcrt
_stricmp
ws2_32
gethostbyname
Sections
.text Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 290KB - Virtual size: 289KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ