Static task
static1
Behavioral task
behavioral1
Sample
91ec49ff257c55dd4b774716ca60ec7e_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
91ec49ff257c55dd4b774716ca60ec7e_JaffaCakes118
-
Size
44KB
-
MD5
91ec49ff257c55dd4b774716ca60ec7e
-
SHA1
f3116b8af4a160a8d93794b7ff2ca1eead1c7e41
-
SHA256
3748d4715f5382df7871139d61bc9d73b86845acf5025293d15b20c3f8cb14f0
-
SHA512
30a76db252633797de97e958fc5fa1fd942e0766c5834927ba59fc89dd5838fa5c7b3d006944920cb5e8f47500c5938ebd5f1cc9371f5089bb1afbbad53ec2d2
-
SSDEEP
768:jWZyYQlc0QTjM7h5IXfprnasckvtZH3odt0/q+fy5z0QCdwsfDBlLDrYzFgiDiLe:iy1+0QTg7epragLYdtEOz56wsrBZrMFR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 91ec49ff257c55dd4b774716ca60ec7e_JaffaCakes118
Files
-
91ec49ff257c55dd4b774716ca60ec7e_JaffaCakes118.exe windows:10 windows x86 arch:x86
a93ecf36e84ba72fb0376a31c646219a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetModuleHandleA
GetProcAddress
msvcp110_win
?_Xbad_alloc@std@@YAXXZ
msvcrt
exit
api-ms-win-eventing-provider-l1-1-0
EventRegister
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-synch-l1-1-0
ReleaseMutex
api-ms-win-core-heap-l1-1-0
HeapSize
api-ms-win-core-errorhandling-l1-1-0
SetLastError
api-ms-win-core-winrt-string-l1-1-0
WindowsDeleteString
api-ms-win-core-com-l1-1-0
CoCreateGuid
api-ms-win-core-winrt-l1-1-0
RoInitialize
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolTimer
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
policymanager
PolicyManager_GetPolicyInt
api-ms-win-core-registry-l1-1-0
RegCloseKey
api-ms-win-stateseparation-helpers-l1-1-0
GetPersistedRegistryValueW
api-ms-win-core-file-l1-1-0
LockFile
api-ms-win-core-synch-l1-2-1
CreateWaitableTimerW
oleaut32
VariantClear
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
winhttp
WinHttpOpen
api-ms-win-core-version-l1-1-1
GetFileVersionInfoW
api-ms-win-core-version-l1-1-0
VerQueryValueW
api-ms-win-core-sysinfo-l1-2-0
GetProductInfo
ntdll
RtlConvertDeviceFamilyInfoToString
Sections
.MPRESS1 Size: 37KB - Virtual size: 144KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE