Static task
static1
Behavioral task
behavioral1
Sample
0787af7f9d5fbae3d766bf326ef3fb24_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0787af7f9d5fbae3d766bf326ef3fb24_JaffaCakes118.exe
Resource
win10v2004-20240419-en
General
-
Target
0787af7f9d5fbae3d766bf326ef3fb24_JaffaCakes118
-
Size
28KB
-
MD5
0787af7f9d5fbae3d766bf326ef3fb24
-
SHA1
7442c5eaca5be2ae6ddb525a79fae2d43d6af390
-
SHA256
e937564ef7cc31807a7325ffe210935226cf7e9f067aad5c0b6c0be8be342abe
-
SHA512
163bccf00b7a0e2a23d0e92d34afb8355d02300e26c4fdb19033679872c6d99669a7ee65a26d81340015a8d4557ee4a5e535aa49af0973e5988736b0c945ac52
-
SSDEEP
768:H7B+LN+k86JI2sqqxQeqIHPebpwYDYgWv7D3x:bB0N+j6u7fmeK1xnWvx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0787af7f9d5fbae3d766bf326ef3fb24_JaffaCakes118
Files
-
0787af7f9d5fbae3d766bf326ef3fb24_JaffaCakes118.exe windows:5 windows x86 arch:x86
72dad18941a5ae6ede55f1d6e2a19215
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetModuleHandleA
GetProcAddress
user32
GetSystemMetrics
gdi32
DeleteDC
advapi32
FreeSid
shell32
SHGetFolderPathW
msvcp90
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
shlwapi
PathIsRelativeW
gdiplus
GdiplusShutdown
crypt32
CryptMsgClose
wintrust
WinVerifyTrust
msvcr90
exit
userenv
CreateEnvironmentBlock
psapi
GetProcessImageFileNameA
version
VerQueryValueW
Sections
.MPRESS1 Size: 22KB - Virtual size: 84KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE