Static task
static1
Behavioral task
behavioral1
Sample
a2feec517ae940b753881a966426d9c3_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
a2feec517ae940b753881a966426d9c3_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
a2feec517ae940b753881a966426d9c3_JaffaCakes118
-
Size
114KB
-
MD5
a2feec517ae940b753881a966426d9c3
-
SHA1
d1e74e8339ba5650f3395f4758c698cccd8a0f8b
-
SHA256
5bfa9da32aecda631929be640bf0a311a127f16a416e9e3a4e498ce8072f5658
-
SHA512
0469c295617c30fca8db9df669d78f50f2bb2eeba7920f2f137a7c4acd2d49f8eb8da6e87a5cae3ddad8befe33617177be85bce0d5d10cc75b086c3784103503
-
SSDEEP
3072:TtoN1kbG6b6pM2my5Ht4BsRWTxgiayGu:ZoNoGI2m0KBYWTxZj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a2feec517ae940b753881a966426d9c3_JaffaCakes118
Files
-
a2feec517ae940b753881a966426d9c3_JaffaCakes118.exe windows:6 windows x86 arch:x86
8d7474469792a6f10ca26413e6fc3484
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetModuleHandleA
GetProcAddress
msvcrt
free
ntdll
NtClose
api-ms-win-core-kernel32-legacy-l1-1-1
CopyFileW
api-ms-win-core-memory-l1-1-2
VirtualFree
api-ms-win-core-localization-l1-2-1
GetACP
api-ms-win-core-console-l1-1-0
ReadConsoleW
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
api-ms-win-core-file-l1-2-1
ReadFile
api-ms-win-core-errorhandling-l1-1-1
SetLastError
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-processenvironment-l1-2-0
SearchPathW
api-ms-win-core-console-l2-1-0
GetConsoleTitleW
api-ms-win-core-heap-l1-2-0
HeapFree
api-ms-win-security-base-l1-2-0
RevertToSelf
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-sysinfo-l1-2-1
GetVersion
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
api-ms-win-core-datetime-l1-1-1
GetDateFormatW
api-ms-win-core-systemtopology-l1-1-0
GetNumaHighestNodeNumber
api-ms-win-core-processthreads-l1-1-2
OpenThread
api-ms-win-core-registry-l1-1-0
RegCloseKey
api-ms-win-core-file-l2-1-1
MoveFileExW
api-ms-win-core-io-l1-1-1
DeviceIoControl
api-ms-win-core-processtopology-l1-2-0
GetThreadGroupAffinity
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpW
api-ms-win-core-heap-obsolete-l1-1-0
LocalFree
api-ms-win-core-processtopology-obsolete-l1-1-0
SetProcessAffinityMask
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-delayload-l1-1-1
DelayLoadFailureHook
Sections
.MPRESS1 Size: 74KB - Virtual size: 320KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 33KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE