Static task
static1
Behavioral task
behavioral1
Sample
071bebfdf8cfbd6e2e25873bfd5b18c2_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
071bebfdf8cfbd6e2e25873bfd5b18c2_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
071bebfdf8cfbd6e2e25873bfd5b18c2_JaffaCakes118
-
Size
16KB
-
MD5
071bebfdf8cfbd6e2e25873bfd5b18c2
-
SHA1
188218b748b5c4387f778d279fed2f3c4aa96b7a
-
SHA256
3b755835e5f855d8d76e7b240e285405eea10d99accb5ff11bec043a9444db81
-
SHA512
cbbfc4f57c577894ba237b3e4b82277018b3fab127af5807ff551bfaa0f50a484a46203470f726addb94d89451fafa64c8553e2e1b2cce91383443d004f0bc04
-
SSDEEP
384:/CAyb5L5DxbTGGQB/9PfcMGxqltN4GQETWY99+cS:/q1Tq/9PfyclXTWs
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 071bebfdf8cfbd6e2e25873bfd5b18c2_JaffaCakes118
Files
-
071bebfdf8cfbd6e2e25873bfd5b18c2_JaffaCakes118.exe windows:4 windows x86 arch:x86
1e425b04ea26b33e67115dd43865b7fa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
rpcrt4
UuidCreate
psapi
EnumProcesses
EnumProcessModules
GetModuleBaseNameA
kernel32
WinExec
lstrcatA
lstrcpyA
DeleteFileA
MoveFileExA
GetTempFileNameA
GetSystemDirectoryA
CreateProcessA
CloseHandle
Sleep
lstrlenA
CreateFileA
lstrcmpiA
GetProcAddress
LoadLibraryA
OpenProcess
GetProcessHeap
GetModuleHandleA
HeapFree
HeapAlloc
ReadFile
GetFileSizeEx
GetTickCount
GetSystemWindowsDirectoryA
SetFilePointer
WriteFile
WaitForSingleObject
ResumeThread
GetWindowsDirectoryA
SetHandleInformation
GetTempPathA
RemoveDirectoryA
CreateDirectoryA
FindClose
FindNextFileA
FindFirstFileA
GetDriveTypeA
SetThreadContext
FlushInstructionCache
WriteProcessMemory
VirtualProtectEx
GetThreadContext
GetModuleFileNameA
DuplicateHandle
GetLastError
ExitProcess
GetCurrentProcess
GetFileSize
advapi32
CryptEncrypt
CryptImportKey
CryptAcquireContextA
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA
SetServiceStatus
shell32
ShellExecuteA
SHGetFolderPathA
Sections
.text Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ