Static task
static1
Behavioral task
behavioral1
Sample
182ed2bd7d1914c015a772c5f2fc0830_JaffaCakes118.exe
Resource
win10v2004-20240419-en
General
-
Target
182ed2bd7d1914c015a772c5f2fc0830_JaffaCakes118
-
Size
156KB
-
MD5
182ed2bd7d1914c015a772c5f2fc0830
-
SHA1
1e31ed472434428658e2f623b98a22e0cd96293d
-
SHA256
97102b7b65e78d3f404a07a4b6ed851059ea6d8d00785902076bb022c0f77328
-
SHA512
ef267fa73d066ad9455017fad5036901f713a1c19fd8af818e64d6eca434799194de14f2fd2e6434076be7fb11e5b0196992677a733a3791a412b337f99b03ea
-
SSDEEP
3072:etH/g/r93m+89Me0xvD48zjtOIThPPFJRAhPiEABm:GHoDgHLy4OpDeP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 182ed2bd7d1914c015a772c5f2fc0830_JaffaCakes118
Files
-
182ed2bd7d1914c015a772c5f2fc0830_JaffaCakes118.exe windows:10 windows x86 arch:x86
1c5f89a949fbef29b68038fb87180db6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetModuleHandleA
GetProcAddress
msvcrt
exit
ntdll
RtlLengthSid
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-eventing-provider-l1-1-0
EventWrite
api-ms-win-security-base-l1-2-0
AddAce
api-ms-win-core-errorhandling-l1-1-1
GetLastError
api-ms-win-core-libraryloader-l1-2-0
FreeLibrary
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-processthreads-l1-1-2
TlsFree
api-ms-win-core-processenvironment-l1-2-0
GetCommandLineW
api-ms-win-core-string-l1-1-0
CompareStringW
api-ms-win-core-heap-l1-2-0
HeapFree
api-ms-win-core-registry-l1-1-0
RegCloseKey
api-ms-win-core-memory-l1-1-2
MapViewOfFile
api-ms-win-core-sysinfo-l1-2-1
GetTickCount
api-ms-win-core-localization-l1-2-1
LCMapStringW
api-ms-win-core-threadpool-legacy-l1-1-0
ChangeTimerQueueTimer
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-kernel32-legacy-l1-1-1
GetStartupInfoA
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
fastprox
?New@CWbemCallSecurity@@SGPAV1@XZ
ncobjapi
WmiDestroyObject
wbemcomn
GetMemLogObject
api-ms-win-core-delayload-l1-1-1
DelayLoadFailureHook
Sections
.MPRESS1 Size: 87KB - Virtual size: 420KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 63KB - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE