Static task
static1
Behavioral task
behavioral1
Sample
2902917c57c91966f706c2d786597e50_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
2902917c57c91966f706c2d786597e50_JaffaCakes118
-
Size
19KB
-
MD5
2902917c57c91966f706c2d786597e50
-
SHA1
2b3c30e08f8bced42a8dfec0d51d1db1f6d04d24
-
SHA256
4f09e610394596c413a76c787fd2e4761092d9f89d344633e0cf59fcf91bf760
-
SHA512
2bbb066f582abf211b59b44000a7294780df70599cdc6097947c7ce3c7df904fcc9a1d6d319f29f628b57bdbe1f4a572467bce7adb9cefd7f99573b997768888
-
SSDEEP
384:ONTX5C6iPHDmiXGkSbg/TUnQirCE7YxTS+AI1XDNuYpSZWPSWI6:ONo6Q9XGRbg7UNATMGxudec6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2902917c57c91966f706c2d786597e50_JaffaCakes118
Files
-
2902917c57c91966f706c2d786597e50_JaffaCakes118.exe windows:10 windows x86 arch:x86
53b1feec1a1681bb8c95e840728510fb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetModuleHandleA
GetProcAddress
msvcrt
exit
api-ms-win-core-heap-l1-1-0
HeapFree
api-ms-win-core-errorhandling-l1-1-0
GetErrorMode
api-ms-win-core-processenvironment-l1-1-0
GetCommandLineW
api-ms-win-core-com-l1-1-0
IIDFromString
api-ms-win-core-winrt-string-l1-1-0
WindowsDeleteString
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
api-ms-win-core-synch-l1-1-0
SetEvent
api-ms-win-core-processthreads-l1-1-1
OpenProcess
api-ms-win-eventing-classicprovider-l1-1-0
TraceMessage
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-processthreads-l1-1-0
TlsGetValue
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-libraryloader-l1-2-0
FreeLibrary
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
api-ms-win-core-debug-l1-1-0
DebugBreak
api-ms-win-appmodel-runtime-l1-1-2
AppPolicyGetMediaFoundationCodecLoading
mfcore
MFCreatePMPHost
mfplat
MFStartup
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
Sections
.MPRESS1 Size: 13KB - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE