Static task
static1
Behavioral task
behavioral1
Sample
50c161520dd778f029eba9d2a83b9f31_JaffaCakes118.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
50c161520dd778f029eba9d2a83b9f31_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
50c161520dd778f029eba9d2a83b9f31_JaffaCakes118
-
Size
131KB
-
MD5
50c161520dd778f029eba9d2a83b9f31
-
SHA1
9964a47db01f442b4b063634c183e03607249db0
-
SHA256
4524ba3be5a64c517faa4730f6fa8845a62d7ed3da08302361ef634b8eb97aae
-
SHA512
eceaac623313ecf5c54bc24e65d07aaea8e487c9543c1575f55cde78f207bc546d457f0a2bcd43f8a57c4f66ac2c797e7e91141fd3c2421ff2f6177223e5a949
-
SSDEEP
3072:CJaGEqudcAo7t50LA+ixCOStji4YRgRfal5iECd:AabcAo7D0LAEOStjlM4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 50c161520dd778f029eba9d2a83b9f31_JaffaCakes118
Files
-
50c161520dd778f029eba9d2a83b9f31_JaffaCakes118.exe windows:5 windows x86 arch:x86
186deb2fb00f1400ebdc10c14f96d123
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetModuleHandleA
GetProcAddress
user32
GetDC
gdi32
Escape
winspool.drv
OpenPrinterW
advapi32
RegCloseKey
shell32
CommandLineToArgvW
ole32
CoCreateGuid
oleaut32
VariantClear
shlwapi
PathFileExistsW
oleacc
LresultFromObject
wtsapi32
WTSQueryUserToken
userenv
CreateEnvironmentBlock
winhttp
WinHttpCloseHandle
Sections
.MPRESS1 Size: 124KB - Virtual size: 384KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE