Static task
static1
Behavioral task
behavioral1
Sample
5c80ecc2af025cc8401d43c0099b9e32_JaffaCakes118.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
5c80ecc2af025cc8401d43c0099b9e32_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
5c80ecc2af025cc8401d43c0099b9e32_JaffaCakes118
-
Size
32KB
-
MD5
5c80ecc2af025cc8401d43c0099b9e32
-
SHA1
c418bacbf7ff9aad6dbe0c9043f567553ca74fbe
-
SHA256
30ebcda2c173cf97ed11aee677c2fe98fd0e6db08db64c1fa505e323766efee4
-
SHA512
e604a038c4d0d45ed1ce592df9aba681392ccdfee058bd20cabc48618207fc981658241cfbef59aad0b78f254a1daa90b09d5a2a1b460712797d12cb2bb9780d
-
SSDEEP
768:q3sf3qkUa9e7AUu/Q5clt3q+00ggioTz1Uz7DN:hf3qbaAfuhlta+PzOp
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5c80ecc2af025cc8401d43c0099b9e32_JaffaCakes118
Files
-
5c80ecc2af025cc8401d43c0099b9e32_JaffaCakes118.exe windows:5 windows x86 arch:x86
88ded7d314029b3c459be87683299ab7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetModuleHandleA
GetProcAddress
user32
CloseDesktop
advapi32
DuplicateTokenEx
psapi
GetProcessImageFileNameA
wtsapi32
WTSQueryUserToken
userenv
CreateEnvironmentBlock
Sections
.MPRESS1 Size: 27KB - Virtual size: 84KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE