Static task
static1
Behavioral task
behavioral1
Sample
6ed944b59ddc242692af34934343f974_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6ed944b59ddc242692af34934343f974_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
6ed944b59ddc242692af34934343f974_JaffaCakes118
-
Size
3.6MB
-
MD5
6ed944b59ddc242692af34934343f974
-
SHA1
2174096bbe568eccdce72c71082925dd3c89383f
-
SHA256
c14811c44b7894f0dde86cc7817b0bc1f9fcf958e98780fe3921b5d7dd6f1ccc
-
SHA512
7dabc846a745307f56a65ebda721065e49269fb35d00377fa1a8fc8b53ac7b12b09ee0f0b4df364885a00cb7cfa4ed778ffaf980125716475d95f0baec596d02
-
SSDEEP
98304:xK3TRIs+kWhFB6pYZ/8Bbfdk1qhF/wt4OAwQe:xK3TRIbkWIpYZUBbfdkooa
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6ed944b59ddc242692af34934343f974_JaffaCakes118
Files
-
6ed944b59ddc242692af34934343f974_JaffaCakes118.exe windows:5 windows x86 arch:x86
1c3a316681952eb61fb31e65c8d18b62
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetVersion
GetVersionExA
GetVersion
GetExitCodeThread
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CallNextHookEx
advapi32
RegCreateKeyExA
oleaut32
SafeArrayGetUBound
version
GetFileVersionInfoA
gdi32
ExcludeClipRect
ole32
IsEqualGUID
comctl32
ImageList_Write
shell32
ShellExecuteExA
comdlg32
GetSaveFileNameA
Sections
CODE Size: - Virtual size: 760KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 9KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 3.6MB - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 260B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 944B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ