Static task
static1
Behavioral task
behavioral1
Sample
9c7448159cd16ba85bab1b198cebf8b2dd476693e9593b378998d352808715b7.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9c7448159cd16ba85bab1b198cebf8b2dd476693e9593b378998d352808715b7.exe
Resource
win10v2004-20240508-en
General
-
Target
65b908c8a3dacfb5b1aea243a6ed294c_JaffaCakes118
-
Size
2KB
-
MD5
65b908c8a3dacfb5b1aea243a6ed294c
-
SHA1
784137c6972dc0d717a55c4f3d02311ab0f95246
-
SHA256
00c15417c3cd0e57a74373943fd30518bb9b2ff4b49472ea9efab6b47414df44
-
SHA512
5b5a00cf8967182afd36045b54127ff58e69e782b0fa953b540c6e0154abbe374a8dbdf35de51df3e5065521b6322c48a8283daa4ec09d505594823b97dc0539
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource unpack001/9c7448159cd16ba85bab1b198cebf8b2dd476693e9593b378998d352808715b7
Files
-
65b908c8a3dacfb5b1aea243a6ed294c_JaffaCakes118.zip
Password: infected
-
9c7448159cd16ba85bab1b198cebf8b2dd476693e9593b378998d352808715b7.exe windows:1 windows x86 arch:x86
691560fd20b90b1d5cf5932bf3681199
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
FindClose
CreateFileA
CloseHandle
ReadFile
CreateMutexA
CreateThread
ExitProcess
CreateEventA
FindNextFileA
FindFirstFileA
GetCurrentDirectoryA
GetLastError
GlobalAddAtomA
GlobalAlloc
GlobalFindAtomA
GlobalFree
IsDebuggerPresent
CreateFileMappingA
CreateMailslotA
ResumeThread
ReleaseMutex
SetCurrentDirectoryA
SetEndOfFile
SetEvent
SetFileAttributesA
SetFilePointer
SetFileTime
SetThreadPriority
Sleep
UnmapViewOfFile
WaitForSingleObject
WriteFile
lstrcatA
lstrcmpiA
lstrcpyA
lstrlenA
MapViewOfFile
user32
ReleaseDC
MessageBoxA
GetSystemMetrics
gdi32
TextOutA
SetBkMode
SelectObject
GetStockObject
CreateDCA
Sections
CODE Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DATA Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ