Static task
static1
Behavioral task
behavioral1
Sample
ffe035f33d38cb1bc022c2ed10454b6e_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ffe035f33d38cb1bc022c2ed10454b6e_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
ffe035f33d38cb1bc022c2ed10454b6e_JaffaCakes118
-
Size
919KB
-
MD5
ffe035f33d38cb1bc022c2ed10454b6e
-
SHA1
51ee4a877dbc5f9e4d5286e80db8bd00cf36e826
-
SHA256
4450663628a0c753268e8f2ea0c0168c74ccbf5c87c61c50f5ef1a045a07a705
-
SHA512
9e216fe5a5c5ebb89721d6e7011daa3b79640d4ae113b350f2bc3a20dcb2073b67cda66d440816492379d9d77957f4ec8a06c8b3ea2bdcb49116accf914dd28b
-
SSDEEP
24576:MDgyu+LVtxB7Rxv67vb2qMC13AlZ07tO6DvKpG5a7yT:GgaVtxB7Rxv6X3AlZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource ffe035f33d38cb1bc022c2ed10454b6e_JaffaCakes118
Files
-
ffe035f33d38cb1bc022c2ed10454b6e_JaffaCakes118.exe windows:4 windows x86 arch:x86
c01d80ccf64296efe4faefca504ba3f1
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
advapi32
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
ntdll
NtWaitForSingleObject
ws2_32
WSAGetOverlappedResult
kernel32
AddVectoredExceptionHandler
CloseHandle
CreateEventA
CreateThread
CreateWaitableTimerA
DuplicateHandle
ExitProcess
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetProcAddress
GetQueuedCompletionStatus
GetStdHandle
GetSystemInfo
GetThreadContext
LoadLibraryW
LoadLibraryA
ResumeThread
SetConsoleCtrlHandler
SetErrorMode
SetEvent
SetProcessPriorityBoost
SetThreadPriority
SetUnhandledExceptionFilter
SetWaitableTimer
SuspendThread
VirtualAlloc
VirtualFree
WaitForSingleObject
WriteFile
winmm
timeBeginPeriod
Sections
.text Size: 908KB - Virtual size: 907KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 105KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.symtab Size: 5KB - Virtual size: 5KB
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ