Static task
static1
Behavioral task
behavioral1
Sample
f8e6faa94983b420aa380a4475816947_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
f8e6faa94983b420aa380a4475816947_JaffaCakes118
-
Size
477KB
-
MD5
f8e6faa94983b420aa380a4475816947
-
SHA1
d6790bc09d3b11d986d79fcedb101225d6102251
-
SHA256
c667e476be761d121a662d122548ed4ea03e4a2809d453376a99df65598421a8
-
SHA512
e88a9a8b67fefdede031366e25fd50f90d7ce92967396693856b632b7127b8fb22d042ab720d42d0ad4096b43bd002e101c7fb12bef7c0cd73742ae959c92bbb
-
SSDEEP
12288:JRdLS1Nq7ah+DeowGBDyo7x4R6ASa9kPseKUs3K60CS:fd211hnowGAGx4wAxkPselsJfS
Malware Config
Signatures
-
Molebox Virtualization software 1 IoCs
Detects file using Molebox Virtualization software.
Processes:
resource yara_rule sample molebox -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource f8e6faa94983b420aa380a4475816947_JaffaCakes118
Files
-
f8e6faa94983b420aa380a4475816947_JaffaCakes118.exe windows:4 windows x86 arch:x86
5549afdec7106febd0f708bda733b0de
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
advapi32
RegCloseKey
RegOpenKeyExW
RegSetValueA
kernel32
CreateFileA
ExitProcess
MapViewOfFile
SetUnhandledExceptionFilter
TerminateProcess
msvcrt
__getmainargs
__p__environ
__p__fmode
__set_app_type
_cexit
_iob
_onexit
_setmode
abort
atexit
memcpy
signal
strcpy
wcscpy
user32
CheckMenuRadioItem
ClientToScreen
CreateAcceleratorTableW
DestroyMenu
DrawIconEx
DrawMenuBar
DrawStateW
EnumClipboardFormats
GetCursorPos
GetDlgItem
GetForegroundWindow
GetMessagePos
GetMessageW
GetSystemMetrics
GetWindowRect
GetWindowTextW
IsIconic
LoadIconW
MsgWaitForMultipleObjects
PeekMessageW
PostQuitMessage
SetClipboardData
SetWindowTextW
UnionRect
Sections
.text Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 72B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 333KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 2KB - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ