Static task
static1
Behavioral task
behavioral1
Sample
0ffe3d79d87f25a2e6f65cbc2d3cb3af_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0ffe3d79d87f25a2e6f65cbc2d3cb3af_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
0ffe3d79d87f25a2e6f65cbc2d3cb3af_JaffaCakes118
-
Size
208KB
-
MD5
0ffe3d79d87f25a2e6f65cbc2d3cb3af
-
SHA1
8eeb3ae5bd45cc4ad547710f7fc07007cd0e5e96
-
SHA256
1bf51fe3ba03be27895f00a04d6281993b1edfe43fb98e4a84b773ec670f7a6b
-
SHA512
0bae7bc159c17bbe9046913a1f86e4fe299389d3187941a1d7f3c5037dd64fa958afce66bbcbff07e83326877e5463707c81d7eb119ffb9902d8f64478e443a0
-
SSDEEP
3072:lxqTTDlEj6l+et0XNOAXMiaGvZtGHdz0DDL47vU:lxqWG8eSAxiFvvGHGDP8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0ffe3d79d87f25a2e6f65cbc2d3cb3af_JaffaCakes118
Files
-
0ffe3d79d87f25a2e6f65cbc2d3cb3af_JaffaCakes118.exe windows:4 windows x86 arch:x86
0b3b13dd895fdf372c92e50bba47b027
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Process32Next
Process32First
CreateToolhelp32Snapshot
Thread32Next
Thread32First
FindFirstFileA
CloseHandle
ResumeThread
TerminateProcess
SuspendThread
OpenProcess
Sleep
ExitProcess
GetModuleFileNameA
GetProcAddress
LoadLibraryA
GetModuleHandleA
GlobalFree
ReadProcessMemory
GlobalAlloc
SetThreadContext
WriteProcessMemory
VirtualProtectEx
GetThreadContext
GetExitCodeThread
WaitForSingleObject
CreateRemoteThread
GetVersion
VirtualProtect
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
MultiByteToWideChar
GetStartupInfoA
GetCommandLineA
GetVersionExA
GetCurrentProcess
WriteFile
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetLastError
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapDestroy
HeapCreate
VirtualFree
HeapFree
GetACP
GetOEMCP
GetCPInfo
HeapAlloc
VirtualAlloc
HeapReAlloc
RtlUnwind
InterlockedExchange
VirtualQuery
HeapSize
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringA
GetSystemInfo
user32
EndDialog
GetDlgItemTextA
MessageBoxA
GetAsyncKeyState
DialogBoxParamA
Sections
.text Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 168KB - Virtual size: 168KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.aspack Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE