Static task
static1
Behavioral task
behavioral1
Sample
170170eaad52728c51f3cf930443a9b9_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
170170eaad52728c51f3cf930443a9b9_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
170170eaad52728c51f3cf930443a9b9_JaffaCakes118
-
Size
92KB
-
MD5
170170eaad52728c51f3cf930443a9b9
-
SHA1
ea2c6508baf9669d0d143edf05993da2a60c6f26
-
SHA256
53435e8a869b45bf0a8da8ede3b2bbb110bd7816913e1d241014a1e3b7759f44
-
SHA512
c8c591ca0948d928a0eaee1cc216a0509901c61b880214cd2e1078413573ebb0576ecb0e95ec5502339655f6ff2a7113ace3bde6fcef29af09114e7491a91f6e
-
SSDEEP
1536:Roz6aeWNqPCv0B1wn301aK46JNYWC8xJwijwl2vs9xa3+P5:G6vWN8ZTGRMHkl2Z3+R
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 170170eaad52728c51f3cf930443a9b9_JaffaCakes118
Files
-
170170eaad52728c51f3cf930443a9b9_JaffaCakes118.exe windows:4 windows x86 arch:x86
81e702294788b785c9eac5f5ef9b7ef1
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
InterlockedExchange
GetACP
GetLocaleInfoA
GetVersionExA
RaiseException
InitializeCriticalSection
DeleteCriticalSection
GetProcAddress
LoadLibraryA
lstrcpynA
GetLastError
GetModuleFileNameA
lstrcpyA
CreateDirectoryA
GetTempFileNameA
GetTempPathA
SizeofResource
LockResource
LoadResource
FindResourceA
lstrlenA
SetFilePointer
CreateFileA
CloseHandle
WriteFile
MultiByteToWideChar
InterlockedDecrement
LocalFree
GetSystemInfo
VirtualProtect
GetCPInfo
GetOEMCP
GetStringTypeW
GetStringTypeA
IsBadCodePtr
IsBadReadPtr
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
ExitProcess
RtlUnwind
HeapFree
GetSystemTimeAsFileTime
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
HeapReAlloc
HeapAlloc
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
VirtualQuery
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
SetUnhandledExceptionFilter
TerminateProcess
GetCurrentProcess
HeapSize
LCMapStringA
WideCharToMultiByte
LCMapStringW
GetStdHandle
UnhandledExceptionFilter
shlwapi
StrStrA
PathAppendA
ole32
CoSetProxyBlanket
CoInitializeEx
CoCreateInstance
CoInitializeSecurity
CoUninitialize
oleaut32
VariantClear
VariantChangeType
VariantInit
SysFreeString
SysAllocString
Sections
.text Size: 60KB - Virtual size: 57KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 269KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ