Static task
static1
Behavioral task
behavioral1
Sample
789307838ae9776a7a731f45cbca6c6b_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
789307838ae9776a7a731f45cbca6c6b_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
789307838ae9776a7a731f45cbca6c6b_JaffaCakes118
-
Size
236KB
-
MD5
789307838ae9776a7a731f45cbca6c6b
-
SHA1
f21e500dd7b9a584f1bf0e7b40689ae8be992879
-
SHA256
e0bcdf72548067cadf75c9a9d6b11d958b48618e8293ac61992de2262deb77ab
-
SHA512
88bb22f71b06034dab94ef27d2ebc49c4a48d0fe440d3f8da941db1da3e07a0e3a2fd2cd07833eff5fca5dbd4bee896f0f09f52b3760cf79a32006d6208b4328
-
SSDEEP
1536:+EU+1MHn0nC2ON6I98f3M34lET5A8P239oQhk:+Max2Ov9k3m4yT5Ac29
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 789307838ae9776a7a731f45cbca6c6b_JaffaCakes118
Files
-
789307838ae9776a7a731f45cbca6c6b_JaffaCakes118.exe windows:5 windows x86 arch:x86
685ca99f5a2558cca90db43be488204f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
TerminateProcess
GetAtomNameW
lstrcatA
ExitThread
GetLastError
SetLastError
GetProcAddress
SetConsoleCtrlHandler
TransmitCommChar
GetCommMask
LoadLibraryW
CreateToolhelp32Snapshot
DuplicateHandle
CloseHandle
lstrcpyW
lstrcpyA
LCMapStringW
LCMapStringA
GlobalAlloc
EscapeCommFunction
GetTickCount
GetModuleHandleW
GetCurrentProcess
GetNativeSystemInfo
VirtualProtect
ExitProcess
GetStringTypeW
GetStringTypeA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
GetStartupInfoA
RaiseException
RtlUnwind
HeapAlloc
HeapFree
WriteFile
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
FlushFileBuffers
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
InterlockedDecrement
SetHandleCount
GetStdHandle
GetFileType
MultiByteToWideChar
Sleep
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
VirtualFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
VirtualAlloc
HeapReAlloc
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetFilePointer
SetStdHandle
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
LoadLibraryA
CreateFileA
GetLocaleInfoA
user32
PostMessageW
Sections
.text Size: 64KB - Virtual size: 63KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 46KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.version Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 105KB - Virtual size: 105KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ