Static task
static1
Behavioral task
behavioral1
Sample
17ab9d7830b4d45e2ff6dda7f43f3e13_JaffaCakes118.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
17ab9d7830b4d45e2ff6dda7f43f3e13_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
17ab9d7830b4d45e2ff6dda7f43f3e13_JaffaCakes118
-
Size
76KB
-
MD5
17ab9d7830b4d45e2ff6dda7f43f3e13
-
SHA1
edc6236812e1208806b072e0b30fb1179c12e1d2
-
SHA256
e640c0848cc5df405a7c6604663bb459d114d921d41971d75c5b01b78fe1f894
-
SHA512
fa91f633f88be4f04b296e7d88a1e25bbb1112a9f7a7a3811ae1993744f7b9b39879c57f4139c5ef8f31324690e4d5d6f7f60ea90f39fac1969597c26847032c
-
SSDEEP
1536:fDs9/Qs1NDRuZuT+dJknAKc7wZ92jedaurtkjYJqFAwRsQD84Zw:fA9/SuT6J6A9i8AqFDsPp
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 17ab9d7830b4d45e2ff6dda7f43f3e13_JaffaCakes118
Files
-
17ab9d7830b4d45e2ff6dda7f43f3e13_JaffaCakes118.exe windows:4 windows x86 arch:x86
b80ab1f6db6508975af679b2ebc50aff
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Sleep
GetLastError
SetFileAttributesA
GetSystemDirectoryA
GetFileAttributesA
GetTempPathA
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
RtlUnwind
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
DeleteFileA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
GetCPInfo
GetACP
GetOEMCP
SetHandleCount
GetFileType
GetStdHandle
HeapDestroy
HeapCreate
VirtualFree
WriteFile
HeapFree
HeapAlloc
VirtualAlloc
GetProcAddress
LoadLibraryA
Sections
.text Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 1024B - Virtual size: 823B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1024B - Virtual size: 998B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.drdata Size: 60KB - Virtual size: 60KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE