Static task
static1
Behavioral task
behavioral1
Sample
7146abc7e87f02c48e85cb903a197b6f_JaffaCakes118.exe
Resource
win7-20240220-en
General
-
Target
7146abc7e87f02c48e85cb903a197b6f_JaffaCakes118
-
Size
215KB
-
MD5
7146abc7e87f02c48e85cb903a197b6f
-
SHA1
da9a9e256e5a37be885f306831ba7637d305e36b
-
SHA256
96be5b3103eabba9015ff9a80543e63540a8ac3ac6b979f527af0f2e5d06b0f2
-
SHA512
1f1295fe6de58497b887a86fa5df42900009ffbf771436dcbebdc50945d94de4ff013112ca70d114e6f0dcda0ec58897313ac3152e7bcca6d838d3ce7996f0a0
-
SSDEEP
3072:1myVc6uHa8yCjHyMOt2zsanfsQZpw/lDp2bJ:LC9LTjHyMNfnfsQE/1W
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 7146abc7e87f02c48e85cb903a197b6f_JaffaCakes118
Files
-
7146abc7e87f02c48e85cb903a197b6f_JaffaCakes118.exe windows:5 windows x86 arch:x86
60941fc498a474b0a4ae88a61b27ff42
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
PathIsRootA
msi
ord30
gdi32
SetTextAlign
StrokePath
GetSystemPaletteEntries
urlmon
CompatFlagsFromClsid
winspool.drv
DeleteFormW
advapi32
QueryUsersOnEncryptedFile
RemoveUsersFromEncryptedFile
kernel32
UnlockFileEx
GetSystemPowerStatus
GetSystemTimes
GetSystemDefaultLCID
HeapCompact
GetModuleHandleA
GetStartupInfoW
SetFileBandwidthReservation
powrprof
PowerRestoreDefaultPowerSchemes
msvcrt
fgetws
user32
DispatchMessageW
BeginDeferWindowPos
ToUnicodeEx
Sections
.text Size: 184KB - Virtual size: 183KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 25KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ