Static task
static1
Behavioral task
behavioral1
Sample
f602f271d56c64cb2f0c1f78301f07ba_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f602f271d56c64cb2f0c1f78301f07ba_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f602f271d56c64cb2f0c1f78301f07ba_JaffaCakes118
-
Size
111KB
-
MD5
f602f271d56c64cb2f0c1f78301f07ba
-
SHA1
63beb43bfef66ed042569b7f2b674099263de4d3
-
SHA256
75f4a13671db71cac44f72cb4194e47a8e553174ee75c0486d578307d4279fea
-
SHA512
bccdfecf6f04e9611484c73da876e5aed712995761274de66130cebcb9d87f220b124f3f2aee15965258ca74fd96a7c6d1c8633ccbcc2b692fff3806403e78f1
-
SSDEEP
3072:I6ljweKWdDWjqdWqtwhR3EiINyxeb7rtK9T4uLXESPHdJ:jwrWRrkqtwX3rIAStK988XES9
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f602f271d56c64cb2f0c1f78301f07ba_JaffaCakes118
Files
-
f602f271d56c64cb2f0c1f78301f07ba_JaffaCakes118.exe windows:1 windows x86 arch:x86
04215cddfbea3e880a5fb9ad346b4149
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
GetCurrentProcess
ReadFile
LoadLibraryA
CreateFileW
Sleep
LeaveCriticalSection
VirtualAlloc
GetProcessHeap
LoadLibraryW
QueryPerformanceCounter
GetProcessHeap
LoadLibraryW
GetCommandLineA
GetCommandLineW
SetUnhandledExceptionFilter
InterlockedDecrement
LocalFree
SetFilePointer
GetCommandLineW
TerminateProcess
HeapDestroy
CreateFileW
UnhandledExceptionFilter
UnhandledExceptionFilter
lstrcpyW
user32
IsIconic
PostMessageW
wsprintfA
DefWindowProcW
advapi32
RegQueryValueExW
RegQueryValueExW
GetTokenInformation
FreeSid
Sections
.text Size: 105KB - Virtual size: 108KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.reloc Size: 512B - Virtual size: 20B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE