Static task
static1
Behavioral task
behavioral1
Sample
MR-ASH~1.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
MR-ASH~1.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral3
Sample
MR-HAP~1.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
MR-HAP~1.exe
Resource
win10v2004-20240412-en
General
-
Target
f8b2d8c02b2671b2b8aedac2277d7722_JaffaCakes118
-
Size
27KB
-
MD5
f8b2d8c02b2671b2b8aedac2277d7722
-
SHA1
1a3e0c9403b0c18bf37f844eb04a063eb706b8b2
-
SHA256
7f2220ecfdb74b1024871aeedf0b92b824e274e7adf6c3cf4e1b20d3eb1efb9b
-
SHA512
f09f2fc1cd36be3c4ab23253eece0b90b0e4582406f7bbfe7e3640e0550385616f2e6a97281642ae8e38a7bb68847c7bfcce0b81d9472e48438a183ef73e2f62
-
SSDEEP
384:2RVKNWEtPix8PWGDjhNk+n3PBR0zDmShSK6Z5rPUP9/ugI9S7WGJPtFcWEZ6BxeM:2PytdWP+//0PnSK6345uovPcB6BERmtj
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/MR-ASH~1.EXE unpack001/MR-HAP~1.EXE
Files
-
f8b2d8c02b2671b2b8aedac2277d7722_JaffaCakes118.cab
-
MR-ASH~1.EXE.exe windows:4 windows x86 arch:x86
482ea7b49481ccb9a2f155f65a5d858f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcAddress
GetModuleHandleA
GetTickCount
HeapAlloc
GetCommandLineA
GetStartupInfoA
GetCommandLineA
GetProcessHeap
user32
MessageBoxA
Sections
.text Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
MR-HAP~1.EXE.exe windows:4 windows x86 arch:x86
482ea7b49481ccb9a2f155f65a5d858f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcAddress
GetModuleHandleA
GetTickCount
HeapAlloc
GetCommandLineA
GetStartupInfoA
GetCommandLineA
GetProcessHeap
user32
MessageBoxA
Sections
.text Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ