Static task
static1
Behavioral task
behavioral1
Sample
0172e42aff816a1dc607ba6eb0142999_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
0172e42aff816a1dc607ba6eb0142999_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
0172e42aff816a1dc607ba6eb0142999_JaffaCakes118
-
Size
13KB
-
MD5
0172e42aff816a1dc607ba6eb0142999
-
SHA1
ec25e5500102e7ffd95d2cbdb03561b3c79f17fc
-
SHA256
a2677a44c5092e965e96b3d0ed5dd6957807272217f6450d126c1ff0eda6b299
-
SHA512
24b9bd0477c9d4cd0b2e8a04cf465d103eb0838bb91d5ad549e8e8c2092315c630dcbec9943179c2e8c33a3ed692c5d391a5c59622ae138b3d2bbeb20134cf75
-
SSDEEP
192:af1ddYs8FgZMT83nTXR+8bEZqj7hsoLJTeRg8bZ+M7I6TdhQky7o8:amxFgfzRzbgqjFsGTeRg8bZL7IC7y
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0172e42aff816a1dc607ba6eb0142999_JaffaCakes118
Files
-
0172e42aff816a1dc607ba6eb0142999_JaffaCakes118.exe windows:5 windows x86 arch:x86
9a87c0e7d831f0f5fc9217aa753c0b7d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrlenA
LoadResource
Process32First
WriteFile
Thread32First
TerminateThread
Sleep
SizeofResource
Thread32Next
GetSystemDirectoryA
VirtualAlloc
CopyFileA
OpenThread
Process32Next
MoveFileA
GetModuleFileNameA
GetModuleHandleA
CreateToolhelp32Snapshot
WinExec
CloseHandle
DeleteFileA
lstrcpyA
FindResourceA
CreateFileA
lstrcatA
ExitProcess
user32
wsprintfA
advapi32
RegQueryValueExA
RegOpenKeyA
RegCloseKey
RegEnumValueA
msvcrt
strstr
_stricmp
memcpy
shlwapi
PathRemoveFileSpecA
Sections
.text Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 804B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 404B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ