Static task
static1
Behavioral task
behavioral1
Sample
0e28738d71c1acac5ede96dcc87de2c8_JaffaCakes118.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
0e28738d71c1acac5ede96dcc87de2c8_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
0e28738d71c1acac5ede96dcc87de2c8_JaffaCakes118
-
Size
40KB
-
MD5
0e28738d71c1acac5ede96dcc87de2c8
-
SHA1
b7c390f3e1ecff4d90b91d0c1930fa386608f414
-
SHA256
c40c26077b8d16c33fa71243b18098a6217674d5602bb1748c5af12034d9e82f
-
SHA512
54bf43b31335d934de3b63a678561a596637cd0326a5e6af9e48edf933b168dc7962d83b3ffd5315d887ed3c0e0e79efa493747f7e125aa1a047324994bd1b61
-
SSDEEP
384:NH5A84LLDUCcwZNFvyedyEg4TAhimlFXiHyyuuJxHittThzo:NuewZrpdyECeymzHitphzo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0e28738d71c1acac5ede96dcc87de2c8_JaffaCakes118
Files
-
0e28738d71c1acac5ede96dcc87de2c8_JaffaCakes118.exe windows:4 windows x86 arch:x86
d3db2b2964c6a20023807e7deef8e920
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetFilePointer
CloseHandle
ReadFile
CreateFileA
GetWindowsDirectoryA
TerminateProcess
WaitForSingleObject
GetLastError
CreateEventA
GetACP
WriteFile
DeleteFileA
CopyFileA
GetSystemDirectoryA
SetEvent
WinExec
Process32Next
Process32First
CreateToolhelp32Snapshot
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
LoadLibraryA
GetProcAddress
HeapReAlloc
VirtualAlloc
HeapAlloc
GetOEMCP
GetCPInfo
RtlUnwind
HeapFree
VirtualFree
HeapCreate
GetStringTypeW
HeapDestroy
GetLocalTime
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
user32
PostQuitMessage
TranslateMessage
GetMessageA
SetTimer
ShowWindow
CreateWindowExA
DefWindowProcA
KillTimer
RegisterClassA
DispatchMessageA
wininet
FtpSetCurrentDirectoryA
InternetConnectA
InternetCloseHandle
InternetSetStatusCallback
FtpGetFileA
InternetOpenA
Sections
.text Size: 28KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE