Static task
static1
Behavioral task
behavioral1
Sample
0cb24f3d2b96689aad2d94593e1663d0_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0cb24f3d2b96689aad2d94593e1663d0_JaffaCakes118.exe
Resource
win10v2004-20240419-en
General
-
Target
0cb24f3d2b96689aad2d94593e1663d0_JaffaCakes118
-
Size
50KB
-
MD5
0cb24f3d2b96689aad2d94593e1663d0
-
SHA1
50f8b01ab5475707688e9effe5506e86be749888
-
SHA256
7c40e2a17a2efb1c6fa1fb2fc64f42f30a3ea0b7079da27980653edb761ccee2
-
SHA512
d81d52132118d5789f76f8c853581dee7c67a0121df79bf7301ef3120d5c6e31c16f80c5f056e836f15d0e9ef5772cf05551759f119a0f2fc50510f0cdb92c37
-
SSDEEP
768:rimq71D3vp1qUjP/H2RFLPxU+btpnED6Y6xp/P9ZYw7qgNH3iPHo:6dvqr9PxDtpO6LpthnNXiH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0cb24f3d2b96689aad2d94593e1663d0_JaffaCakes118
Files
-
0cb24f3d2b96689aad2d94593e1663d0_JaffaCakes118.exe windows:5 windows x86 arch:x86
a096dfa409b500472cd05f0482f59c9b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
_acmdln
exit
_cexit
_XcptFilter
_exit
_c_exit
??2@YAPAXI@Z
??3@YAXPAX@Z
_except_handler3
__getmainargs
wcstok
_wtol
advapi32
RegCloseKey
CheckTokenMembership
AllocateAndInitializeSid
RegQueryValueExW
RegOpenKeyExW
FreeSid
kernel32
GetModuleHandleW
FormatMessageW
GetLastError
LocalFree
InterlockedDecrement
CreateProcessW
CloseHandle
InterlockedIncrement
GetCommandLineW
GetModuleHandleA
GetStartupInfoA
ExpandEnvironmentStringsW
user32
DestroyIcon
LoadIconW
ole32
CoUninitialize
CoInitialize
CoCreateInstance
shlwapi
ord219
Sections
.text Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 44KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE