Static task
static1
Behavioral task
behavioral1
Sample
0da566945d53f0620e6a334a8135337b_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0da566945d53f0620e6a334a8135337b_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
0da566945d53f0620e6a334a8135337b_JaffaCakes118
-
Size
274KB
-
MD5
0da566945d53f0620e6a334a8135337b
-
SHA1
4536f89c6e181bbbbad1f13425ad9e7d167bf772
-
SHA256
406db5cf88c21085fbc79c86157d4c9ac5e587887d6f3a84d01be1a5a0a0ebb0
-
SHA512
677aeaea0c70f45a1a7234ed8952da4f6a9e2779e3536b656e9036531a52e46c2379b9ba3ac72ca0b7937fbadcae082217fe46cea98dc2de8aa106bd9d5ef6ce
-
SSDEEP
6144:9K3enn8Op9Ev/O7vS2TC6tGXo8d52qh3767IYa0RjhMI:03TOLCy62T5tUo8d5TL/0R
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0da566945d53f0620e6a334a8135337b_JaffaCakes118
Files
-
0da566945d53f0620e6a334a8135337b_JaffaCakes118.exe windows:5 windows x86 arch:x86
e57fc6312ca3ab50d2df0dc1e0e64207
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetModuleHandleA
GetProcAddress
wsock32
__WSAFDIsSet
version
VerQueryValueW
winmm
timeGetTime
comctl32
ImageList_Remove
mpr
WNetGetConnectionW
wininet
FtpOpenFileW
psapi
EnumProcesses
userenv
LoadUserProfileW
user32
GetDC
gdi32
LineTo
comdlg32
GetSaveFileNameW
advapi32
GetAce
shell32
DragFinish
ole32
CoInitialize
oleaut32
SafeArrayAllocData
Sections
.MPRESS1 Size: 242KB - Virtual size: 720KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE