Static task
static1
Behavioral task
behavioral1
Sample
fdd6b653fb56368a1b6069f64b153b00_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fdd6b653fb56368a1b6069f64b153b00_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
fdd6b653fb56368a1b6069f64b153b00_JaffaCakes118
-
Size
33KB
-
MD5
fdd6b653fb56368a1b6069f64b153b00
-
SHA1
91c6de62e60360a8349ef673b1eef4c74e597b0f
-
SHA256
9424f4038f6e36213512cf49254ee032819abe2f6b27cdf2f7a9978250a694d0
-
SHA512
67578eff2a07d98d14764e9330afb3a6ee412e9199d36e9fd7fbe214a649541b8f9a9ed69d5c0842c25ac819fb25bec1ef23b4bc9b5d0c4a51f0b2a40f778aa3
-
SSDEEP
768:hkI3SOvqPf8hbanF0giu0jkN6vEPA9iw1D:hn3SOvqPjnDiu0ANoEPA99D
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fdd6b653fb56368a1b6069f64b153b00_JaffaCakes118
Files
-
fdd6b653fb56368a1b6069f64b153b00_JaffaCakes118.exe windows:4 windows x86 arch:x86
01a149cbcad766f09fd50201cc28d554
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
advapi32
RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
kernel32
AddAtomA
CloseHandle
CreateSemaphoreA
ExitProcess
FindAtomA
GetAtomNameA
GetCommandLineA
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetStartupInfoA
InterlockedDecrement
InterlockedIncrement
OpenProcess
ReadProcessMemory
ReleaseSemaphore
SetLastError
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
WaitForSingleObject
msvcrt
_itoa
__getmainargs
__p__environ
__p__fmode
__set_app_type
_assert
_cexit
_iob
_onexit
_setmode
abort
atexit
free
malloc
memcpy
memset
signal
strcat
strcmp
strcpy
shell32
ShellExecuteExA
user32
CreateWindowExA
DefWindowProcA
DispatchMessageA
FindWindowA
GetMessageA
GetWindowThreadProcessId
KillTimer
LoadCursorA
LoadIconA
PostQuitMessage
RegisterClassExA
SetTimer
TranslateMessage
Sections
.text Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 128B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 16KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE