Static task
static1
Behavioral task
behavioral1
Sample
4849c41e8d9462c8d701c70ddf22f479_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
4849c41e8d9462c8d701c70ddf22f479_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
4849c41e8d9462c8d701c70ddf22f479_JaffaCakes118
-
Size
84KB
-
MD5
4849c41e8d9462c8d701c70ddf22f479
-
SHA1
1762889345f2d97a0a50a45923731d095932b6c2
-
SHA256
ecddf691447d8928dc12cca0d4d7aa50d835ee7250ca3ec03b075ea5bdf471ea
-
SHA512
997bbfed592f6d6eb692b8222a5de96c1f27e566786b4890103ff72e0e35a481f47390fc6ef91606e28874636288df7cbd8f44a061b64cb5450860104cfc3e2a
-
SSDEEP
384:AvPAcopsmltPzYPSfNyw2zL0+rSnHo09Qbz6:4ATUQEzL04cHoVK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4849c41e8d9462c8d701c70ddf22f479_JaffaCakes118
Files
-
4849c41e8d9462c8d701c70ddf22f479_JaffaCakes118.exe windows:4 windows x86 arch:x86
08d60b4eb50eb190c5575365fa276457
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleFileNameW
GetVersion
lstrlenA
lstrcatA
ExitProcess
GetModuleFileNameA
lstrcatW
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
HeapFree
GetLastError
CloseHandle
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
HeapCreate
VirtualFree
RtlUnwind
WriteFile
HeapAlloc
VirtualAlloc
HeapReAlloc
SetStdHandle
FlushFileBuffers
GetCPInfo
GetACP
GetOEMCP
GetProcAddress
LoadLibraryA
SetFilePointer
GetStringTypeW
advapi32
RegSetValueExA
RegCloseKey
RegCreateKeyA
zvexescn
InjectLibraryW
UninjectLibraryA
UninjectLibraryW
AutoUnhook
InjectLibraryA
Sections
.text Size: 16KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 56KB - Virtual size: 93KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE