Static task
static1
Behavioral task
behavioral1
Sample
0887baa7d2887e4442aa0ed8af928280_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
0887baa7d2887e4442aa0ed8af928280_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
0887baa7d2887e4442aa0ed8af928280_JaffaCakes118
-
Size
108KB
-
MD5
0887baa7d2887e4442aa0ed8af928280
-
SHA1
71baa5271e5428d995ceff7546421b441bb5d1c2
-
SHA256
b24232ef207aeea9773572df8141535604e6c0e9080ba9411aec4d2f35250008
-
SHA512
7910bdfaadaf7ca43bea82f1db7605cafb67b159edb50b6d5a3d01958eb4b262044b97c0a13f00756c7d0794a3db2e82fdd4a52a2473f6b1e06b2cb227821a2d
-
SSDEEP
3072:cfUKYVbjtIkkp9BMqjXffD/FSt8npmSkUqfM:cfUbPt49BMqbf7NSt8oSkf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0887baa7d2887e4442aa0ed8af928280_JaffaCakes118
Files
-
0887baa7d2887e4442aa0ed8af928280_JaffaCakes118.exe windows:5 windows x86 arch:x86
c87724408f208fa040bfcc67dced3a53
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegQueryValueExA
MakeSelfRelativeSD
RegSetValueW
RegCreateKeyExA
RegCloseKey
TrusteeAccessToObjectW
RegQueryValueExW
RegOpenKeyExA
RegDeleteKeyW
UpdateTraceW
RegSetValueExA
TreeResetNamedSecurityInfoA
WmiDevInstToInstanceNameA
RegSetValueExW
RegCreateKeyExW
StartTraceA
RegOpenKeyExW
kernel32
GetExitCodeProcess
GetCurrentProcessId
SetUnhandledExceptionFilter
VirtualAlloc
GetModuleHandleA
GetCurrentThreadId
GetCurrentProcess
GetStartupInfoA
QueryPerformanceCounter
CreateFiber
TerminateProcess
GetSystemTimeAsFileTime
GetProcAddress
CopyFileExW
GetLastError
GetTickCount
Sections
.textbss Size: - Virtual size: 120KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 103KB - Virtual size: 102KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ