Static task
static1
Behavioral task
behavioral1
Sample
031503c1a4e4c3994e64901204587d84_JaffaCakes118.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
031503c1a4e4c3994e64901204587d84_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
031503c1a4e4c3994e64901204587d84_JaffaCakes118
-
Size
800KB
-
MD5
031503c1a4e4c3994e64901204587d84
-
SHA1
68aa412f42a08c4a6ebdd27793dd3a5f581bc397
-
SHA256
2323d4a8814c40340af57811a08c1924cc2f7b9888243888df29f4ae306c31ba
-
SHA512
24cd3ff5ecfb08bc59eea2a63ad010565d84d4e2289d769e610ac39a32f7ec6019f0ebb5882de2d6fbf4a2efb8b070d6d7da93e4431f9418be05c105e097092d
-
SSDEEP
24576:j8wk/26uSNWQw6ReN6NgUWrMbR8TYlhoB8:gz/hgF6FNkrMb6El
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 031503c1a4e4c3994e64901204587d84_JaffaCakes118
Files
-
031503c1a4e4c3994e64901204587d84_JaffaCakes118.exe windows:5 windows x86 arch:x86
9089d0fa1407016aafcf9003c5de65d2
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetCurrentThread
GetPrivateProfileIntW
ClearCommBreak
LoadLibraryW
lstrlenA
DeviceIoControl
HeapFree
GetStringTypeW
ResumeThread
GetPrivateProfileSectionA
CreateEventW
VirtualProtectEx
TlsGetValue
OpenMutexW
DeleteFileA
HeapDestroy
DeviceIoControl
GetDriveTypeA
GetFileAttributesA
GetProcessHeap
SetLastError
rasapi32
DwEnumEntryDetails
RasDeleteEntryA
DwRasUninitialize
DwCloneEntry
DwRasUninitialize
RasDialA
DwEnumEntryDetails
RasDeleteEntryA
RasDialA
RasDialA
DwCloneEntry
DwRasUninitialize
DwEnumEntryDetails
pdh
PdhGetLogFileSize
PdhCloseLog
PdhAddCounterA
PdhGetLogFileTypeA
Sections
.text Size: 1024B - Virtual size: 800B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 1.4MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 794KB - Virtual size: 794KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
.orpc Size: 512B - Virtual size: 288B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ