Static task
static1
Behavioral task
behavioral1
Sample
f96101745658c1998a5fdcfee18c5d09_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f96101745658c1998a5fdcfee18c5d09_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f96101745658c1998a5fdcfee18c5d09_JaffaCakes118
-
Size
21KB
-
MD5
f96101745658c1998a5fdcfee18c5d09
-
SHA1
56a92b9c9baace141fcd3069c2bc70bf6a58542a
-
SHA256
1220a20561c9cfc83a73e52e08e2aa93911c6edb30a8d3e4bc1740f70d6431d2
-
SHA512
51664e6f5b318f45a9eb05a932b370ad3495054af3c7b77bf657bc266ca42a4da0e953174d36c20777229aeddbefca4548f9cfcb3367eb363c08193e2fd7adc5
-
SSDEEP
192:dyHq/fdBu+46xBp/FQTPGrsomy/fIKHp6EE3JaS8Pbuh0ni/cHT2ZGjrwdRa4Va:doqnu+ZwPEGqkExS8j20ni/cHaIoDT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f96101745658c1998a5fdcfee18c5d09_JaffaCakes118
Files
-
f96101745658c1998a5fdcfee18c5d09_JaffaCakes118.exe windows:4 windows x86 arch:x86
0d94fb58898a40614a8f6ac8505857ec
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetSystemDirectoryA
LockResource
LoadResource
FindResourceA
VirtualFreeEx
WaitForSingleObject
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
Process32Next
lstrcmpiA
Process32First
TerminateProcess
GetCurrentProcess
CreateFileA
GetLastError
DeviceIoControl
MoveFileA
GetWindowsDirectoryA
DeleteFileA
FreeLibrary
CopyFileA
lstrcatW
GetWindowsDirectoryW
GetVersionExA
GlobalFree
LoadLibraryExA
GlobalAlloc
SizeofResource
WriteFile
CloseHandle
FreeResource
GetModuleHandleA
LoadLibraryA
Sleep
GetProcAddress
advapi32
OpenSCManagerA
OpenServiceA
StartServiceA
CloseServiceHandle
RegCreateKeyA
RegSetValueExA
ControlService
shell32
ShellExecuteA
msvcrt
fprintf
strcat
strlen
fclose
fopen
strcpy
Sections
.text Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ