Static task
static1
Behavioral task
behavioral1
Sample
68da20c81fba9c4c59b2979f38894352_JaffaCakes118.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
68da20c81fba9c4c59b2979f38894352_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
68da20c81fba9c4c59b2979f38894352_JaffaCakes118
-
Size
204KB
-
MD5
68da20c81fba9c4c59b2979f38894352
-
SHA1
4a1a2640746caafbf84e804142a7b6368b2c1338
-
SHA256
133e21e07ea5741c212b8ca181b61e6255cc5c9412d7f83baa18d7eb90c2db18
-
SHA512
18ce9e01bb07567602cd43c834f43d63f20881b9f02dcda86139abed013959d8a8990b4df7ad1992ac375a93658b663ad37a312f0ecbf5be102a2151fb66dfce
-
SSDEEP
6144:BpG4ONMNrtop6hoKNSyJD3O+Uk9qjE4k:BU7NMNr+GNZJDDUk9mb
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 68da20c81fba9c4c59b2979f38894352_JaffaCakes118
Files
-
68da20c81fba9c4c59b2979f38894352_JaffaCakes118.exe windows:4 windows x86 arch:x86
520aaa214a083271c2758311e45389d1
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Sleep
VirtualProtect
VirtualAlloc
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
GetProcAddress
HeapFree
GetLastError
CloseHandle
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
GetCurrentThreadId
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
HeapDestroy
HeapCreate
VirtualFree
RtlUnwind
WriteFile
HeapAlloc
InterlockedDecrement
InterlockedIncrement
CreateFileA
HeapReAlloc
SetStdHandle
FlushFileBuffers
GetCPInfo
GetACP
GetOEMCP
LoadLibraryA
SetFilePointer
SetEndOfFile
ReadFile
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
Sections
.text Size: 32KB - Virtual size: 30KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 36KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 128KB - Virtual size: 125KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ