Static task
static1
Behavioral task
behavioral1
Sample
27b17a6d999b2a1dfcdbc94ca4dbc3fd_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
27b17a6d999b2a1dfcdbc94ca4dbc3fd_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
27b17a6d999b2a1dfcdbc94ca4dbc3fd_JaffaCakes118
-
Size
769KB
-
MD5
27b17a6d999b2a1dfcdbc94ca4dbc3fd
-
SHA1
b05c18f98e32c2924d1fa4cd907126d01a9be614
-
SHA256
667a5ef3a8630306f5bce2e5cff70da12d80a4cf3f548f6de0de90c588024410
-
SHA512
34b0010f47f6b0709b71203515f4642817954d62dd0cf0b5ea3505d560779dc52bdf2d347a0d0e77b8ae58c1c221d2986306563c00b1f95dc82b9b44446dfacc
-
SSDEEP
6144:S4wum29joq1lZMQpdNhqom6C9+T+yfKdwkFuJqwkJsTyvkjOBQGt53qCmwOLOJPu:HV1o2Bk9+T+Jd9u7z4x5a1LI/5mCVc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 27b17a6d999b2a1dfcdbc94ca4dbc3fd_JaffaCakes118
Files
-
27b17a6d999b2a1dfcdbc94ca4dbc3fd_JaffaCakes118.exe windows:5 windows x86 arch:x86
063dae723b31ba26432e9775da990737
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetStartupInfoA
LoadLibraryW
Sleep
CreateFileA
GetProcAddress
lstrlenW
GetModuleHandleW
VirtualAlloc
GetModuleHandleA
GetFileAttributesA
FreeLibrary
user32
LoadIconW
advapi32
RegQueryValueExA
RegOpenKeyA
Sections
.text2 Size: 1024B - Virtual size: 1000B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text1 Size: 1024B - Virtual size: 1000B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: 736KB - Virtual size: 736KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 532B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata1 Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ