Static task
static1
Behavioral task
behavioral1
Sample
293c5db3dfcbd285850d6b31ecef0bd6_JaffaCakes118.exe
Resource
win7-20240419-en
General
-
Target
293c5db3dfcbd285850d6b31ecef0bd6_JaffaCakes118
-
Size
552KB
-
MD5
293c5db3dfcbd285850d6b31ecef0bd6
-
SHA1
20c3c64d6d7c176694a0e62b4df19a422a42ba57
-
SHA256
1d753d35301ad833a6ad0b57403d581e531bf3402a7629b33989f7997f65902e
-
SHA512
fc2ad33364878d4a80d15b32dffeb8d888916699e945331617e483126f7141941dde859be36005cc85095630aef322ed8a40c132d0b207f45fca3a0ccdd53759
-
SSDEEP
3072:i05Gl+edkSqsn7pgYx1I5ZYQ4kHUtqt9beLbnxhs2:NGl+ekSqsn7G2I5ZF4k0ct9beLbA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 293c5db3dfcbd285850d6b31ecef0bd6_JaffaCakes118
Files
-
293c5db3dfcbd285850d6b31ecef0bd6_JaffaCakes118.exe windows:5 windows x86 arch:x86
4c2448efbc10cff87156b928501410d3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FlushProcessWriteBuffers
GlobalSize
GetModuleHandleA
TransactNamedPipe
GetModuleFileNameA
FlsFree
GetNamedPipeClientProcessId
GetDynamicTimeZoneInformation
cfgmgr32
CM_Get_Class_Name_ExW
ntdsapi
DsFreeDomainControllerInfoW
shlwapi
StrFromTimeIntervalW
PathGetCharTypeW
PathCreateFromUrlW
setupapi
SetupDiDestroyClassImageList
oleaut32
VarI2FromStr
crypt32
CertAddCTLContextToStore
rpcrt4
RpcServerRegisterIf2
ole32
CoEnableCallCancellation
user32
GetMenuContextHelpId
HideCaret
RegisterDeviceNotificationW
GetKeyboardType
ShowScrollBar
lz32
LZInit
LZSeek
msi
ord30
advapi32
SetSecurityDescriptorControl
GetSidSubAuthority
mprapi
MprAdminInterfaceTransportGetInfo
Sections
.text Size: 428KB - Virtual size: 425KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 104KB - Virtual size: 101KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ