Static task
static1
Behavioral task
behavioral1
Sample
bd4a4ebfcae67c295d2a6e41c40cc860_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
bd4a4ebfcae67c295d2a6e41c40cc860_JaffaCakes118
-
Size
13KB
-
MD5
bd4a4ebfcae67c295d2a6e41c40cc860
-
SHA1
aec6ea43dc8b849f1e917a13aa2ba8ecb533f8b0
-
SHA256
5ce7b500229fbd98069de47ffe27990c488f7a9c8132127df20c914589f71070
-
SHA512
aac9b4a6a50470cce18ddaa9f17e3694ee918e14935047656a915402e98531ace00af19a32bd9f0d70fb481a085d524b089ba038a521db05201e827c71c0c2b4
-
SSDEEP
384:54BmFXni+177adUeFbSjBKhX9Kt2laYYpHWAlW:54az778dFGFsXjaYK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bd4a4ebfcae67c295d2a6e41c40cc860_JaffaCakes118
Files
-
bd4a4ebfcae67c295d2a6e41c40cc860_JaffaCakes118.exe windows:10 windows x86 arch:x86
db7c85612e055148c4be0a8a5bc69503
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetModuleHandleA
GetProcAddress
msvcrt
exit
api-ms-win-core-console-l1-1-0
GetConsoleMode
api-ms-win-core-registry-l1-1-0
RegCloseKey
iphlpapi
Icmp6SendEcho2
api-ms-win-core-localization-l1-2-0
FormatMessageW
ws2_32
WSACleanup
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-errorhandling-l1-1-0
GetLastError
ntdll
RtlIpv4StringToAddressW
api-ms-win-core-heap-l1-1-0
HeapSetInformation
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
api-ms-win-core-processenvironment-l1-1-0
GetEnvironmentVariableW
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-file-l1-1-0
GetFileType
Sections
.MPRESS1 Size: 8KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE