Static task
static1
Behavioral task
behavioral1
Sample
3c6f9999ca214f095c50f8790e9fe02f_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
3c6f9999ca214f095c50f8790e9fe02f_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
3c6f9999ca214f095c50f8790e9fe02f_JaffaCakes118
-
Size
800KB
-
MD5
3c6f9999ca214f095c50f8790e9fe02f
-
SHA1
787a0307203cb82be30b4796d06dc8a306031643
-
SHA256
aa3172425d238bb6d85e940843c046388ae0a2f493ec1102f8ff20685db3ba5e
-
SHA512
b964cda41ccdcb34e62a183e9b9a969eccf6674669bf63eaad503f494dedc25023c44a2e2a52f06cfa62639ae152e40cc2cb89fbd85eab1ddda91a2ed18d9797
-
SSDEEP
24576:HUsMJSOTBT8QKtg1rQWApRr7iAojSeO1NDbyxDy/o6:HUsMYOTVLKtGrQ7niAoj/O19yxDW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3c6f9999ca214f095c50f8790e9fe02f_JaffaCakes118
Files
-
3c6f9999ca214f095c50f8790e9fe02f_JaffaCakes118.exe windows:5 windows x86 arch:x86
210a8fd1b9e4a322d5ab040841aab11e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
lstrlenA
LoadLibraryW
VirtualProtect
DeleteFileA
GetPrivateProfileSectionA
CreateMailslotA
CreateEventW
SuspendThread
GetCurrentThread
ResumeThread
GetDriveTypeA
TlsGetValue
GetProcessVersion
GetStringTypeW
GetProcessHeap
FindAtomA
CreateEventW
HeapFree
SetLastError
CreateEventW
GetPrivateProfileIntW
clbcatq
SetupOpen
ComPlusMigrate
DllGetClassObject
ComPlusMigrate
CheckMemoryGates
SetupOpen
SetupOpen
DllGetClassObject
CheckMemoryGates
CheckMemoryGates
ComPlusMigrate
CheckMemoryGates
CheckMemoryGates
d3dramp
RampOldTri
RampOldTri
g_RampOld_BeadTbl
g_RampOld_BeadTbl
Sections
.text Size: 1024B - Virtual size: 928B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 7KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 794KB - Virtual size: 794KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
.orpc Size: 512B - Virtual size: 70B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE