Static task
static1
Behavioral task
behavioral1
Sample
fa774dc1847419ed5a499508aa3d9062_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fa774dc1847419ed5a499508aa3d9062_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
fa774dc1847419ed5a499508aa3d9062_JaffaCakes118
-
Size
500KB
-
MD5
fa774dc1847419ed5a499508aa3d9062
-
SHA1
280967f76928871cacf37c1e8f10b9be602ed767
-
SHA256
3f8975681e055fc1289dd79f1cbdc904ca7da59d4c4f3b9f3eb082d189e62d80
-
SHA512
fe30e1d4fc9b9342044b7a8f4e7617c974f3d8ea2132d25c4c81a0c0d06e6c94375d2b0bd6040cca31e8bc725cfd983c26ee13e9c39d4fd3a2c994cca0f5596b
-
SSDEEP
12288:c8YaUXRRJyXFZD1DpxVT3NDkjOB4X8a07n8t82ImysuH:c8YaUK1jZB4MFD8t82bnC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fa774dc1847419ed5a499508aa3d9062_JaffaCakes118
Files
-
fa774dc1847419ed5a499508aa3d9062_JaffaCakes118.exe windows:4 windows x86 arch:x86
e944242867322349dcbaf98f971088b6
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
InterlockedIncrement
Sleep
FindClose
LoadResource
InitializeCriticalSection
GetACP
CloseHandle
SetFilePointer
GetTempPathA
GetProcAddress
GetCommandLineA
UnhandledExceptionFilter
DeleteFileA
LockResource
GetCurrentProcessId
GetStartupInfoA
lstrlenW
GlobalUnlock
GetVersionExA
ExitProcess
GetFileAttributesA
EnterCriticalSection
HeapAlloc
GetProcessHeap
VirtualAlloc
GetModuleHandleA
GetVersion
TerminateProcess
GetCurrentProcess
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetCurrentThreadId
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
GetLastError
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
WriteFile
InterlockedDecrement
LeaveCriticalSection
GetCPInfo
GetOEMCP
HeapReAlloc
LoadLibraryA
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
Sections
.text Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 436KB - Virtual size: 438KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ