Static task
static1
Behavioral task
behavioral1
Sample
2fc813b7b265b25b7acbee9fe4c0bc6a_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2fc813b7b265b25b7acbee9fe4c0bc6a_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
2fc813b7b265b25b7acbee9fe4c0bc6a_JaffaCakes118
-
Size
125KB
-
MD5
2fc813b7b265b25b7acbee9fe4c0bc6a
-
SHA1
a5b585508c98f503fe0d07dc03bd484cb26e3963
-
SHA256
0a05953c497442b9a41c5d6845955ae334d7a181ea725e0d29c2bfcd0a2a10df
-
SHA512
a7ee5a134446fdd8308772f1da453b3bb4c5c91c47fd3a4f9336a0466c08342790a793976bba017550c021ad4a8587756471232dbc59f8033c3af68bb5fe4bc7
-
SSDEEP
3072:zuCDuT9gNdA59ZqADUI1mBA1GvDp2+FoAdZzAHLfJB7a:zurTOLAHDt1m1p28dZMHO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2fc813b7b265b25b7acbee9fe4c0bc6a_JaffaCakes118
Files
-
2fc813b7b265b25b7acbee9fe4c0bc6a_JaffaCakes118.exe windows:6 windows x86 arch:x86
cbfb06887aa8000467e8bb5c9e8d28ca
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
user32
MessageBoxW
ntdll
NtSetContextThread
RtlCreateHeap
NtTerminateProcess
RtlFreeHeap
RtlInitUnicodeString
NtWriteVirtualMemory
RtlUnlockHeap
NtQueryInformationFile
RtlEqualUnicodeString
RtlLockHeap
NtQueryDirectoryFile
LdrUnlockLoaderLock
RtlFreeUnicodeString
NtCreateFile
NtClose
NtReadVirtualMemory
RtlAllocateHeap
NtDelayExecution
RtlReleasePebLock
NtFlushInstructionCache
RtlSetCurrentDirectory_U
RtlCompareMemory
RtlDuplicateUnicodeString
NtGetContextThread
LdrLockLoaderLock
LdrShutdownProcess
NtReadFile
RtlDosPathNameToNtPathName_U
RtlGetCurrentDirectory_U
NtResumeThread
NtAllocateVirtualMemory
RtlAcquirePebLock
NtFreeVirtualMemory
RtlExpandEnvironmentStrings_U
Sections
.Anzu Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 117KB - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ