DpOO971k2Q+ACRRVivw84dop54lke
Static task
static1
Behavioral task
behavioral1
Sample
2564da359d80d04c9694514158ede3b2_JaffaCakes118.exe
Resource
win7-20240215-en
General
-
Target
2564da359d80d04c9694514158ede3b2_JaffaCakes118
-
Size
232KB
-
MD5
2564da359d80d04c9694514158ede3b2
-
SHA1
2530df461e454959891ea806c3ff15b6bf51d4ca
-
SHA256
45d879c2e5a55a5c9ac2da5e937e1b531a60ca5a863c44201e4be276ef593619
-
SHA512
d337278b7adf8d856b45d3f185dce95ed452595760368a579fd7e2e0a19e4fe37e04d4f301cc1050a2861f5a2b969144f6bdfeebf71ef1f5d6c37ecd73dd0cb6
-
SSDEEP
1536:KsNolkagL6YpgXBx7wJc68fN6Q+H2Ar5q2lM/xSr9uHObV:7olkP+ZxcJrH2A9DlmSmOJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2564da359d80d04c9694514158ede3b2_JaffaCakes118
Files
-
2564da359d80d04c9694514158ede3b2_JaffaCakes118.exe windows:5 windows x86 arch:x86
9d42d0fcc6f66459bb68d7d5cd939b30
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
FindFirstFileNameTransactedW
AttachConsole
user32
RemoveMenu
lz32
LZSeek
Sections
.text Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
CODE Size: 48KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 48KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Zt_r Size: 64KB - Virtual size: 61KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT4 Size: 36KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ