tyrij
Static task
static1
Behavioral task
behavioral1
Sample
9822c83371bcee064892a2d0125c2b3e_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
9822c83371bcee064892a2d0125c2b3e_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
9822c83371bcee064892a2d0125c2b3e_JaffaCakes118
-
Size
84KB
-
MD5
9822c83371bcee064892a2d0125c2b3e
-
SHA1
d0b4508894d0aed39734dda4570dbc0543c1c008
-
SHA256
b81f9c8388c5c644a2375d6e1fc38395fd8a9d279cabeedf8437bd3848cc6a4a
-
SHA512
16f010a8320c13b6eae3be67884b226e333ed6f98eb08c021165e9b897e099284457eb8096d1f3b1760130a2f1df24249c7a675dad92968b369a11aeae30ef95
-
SSDEEP
1536:ZxNAQ3lTu8TXn/b0wpUvs+aDmaQrHkWsRP8l1de8:ZxNFB37DH+aDmaQrEWsRU7de8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9822c83371bcee064892a2d0125c2b3e_JaffaCakes118
Files
-
9822c83371bcee064892a2d0125c2b3e_JaffaCakes118.exe windows:4 windows x86 arch:x86
61e8102a31b5069ed0d1f7d22bf34b95
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Sleep
GetProcessHeap
GetProcAddress
LoadLibraryA
HeapAlloc
HeapReAlloc
VirtualAlloc
VirtualProtect
VirtualFree
IsBadReadPtr
FreeLibrary
lstrcpyA
CloseHandle
ReadFile
GetFileSize
CreateFileA
DeleteFileA
GetFileAttributesA
ExitProcess
RtlUnwind
RaiseException
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersionExA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapFree
TlsAlloc
SetLastError
GetLastError
TlsFree
TlsSetValue
TlsGetValue
SetUnhandledExceptionFilter
HeapDestroy
HeapCreate
IsBadWritePtr
TerminateProcess
GetCurrentProcess
WriteFile
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
InterlockedExchange
VirtualQuery
InitializeCriticalSection
IsBadCodePtr
GetACP
GetOEMCP
GetCPInfo
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
HeapSize
GetSystemInfo
Exports
Exports
Sections
.text Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE