Static task
static1
Behavioral task
behavioral1
Sample
18970955f050497fa1b335c03ed39259_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
18970955f050497fa1b335c03ed39259_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
18970955f050497fa1b335c03ed39259_JaffaCakes118
-
Size
121KB
-
MD5
18970955f050497fa1b335c03ed39259
-
SHA1
939da74776f42ada3a77d53f8d5e981e350e2f22
-
SHA256
86eeb6d0fb52fdb089f0e1615d0a8a2d0ae3300b739c394bd99966b973293469
-
SHA512
fc9906be3f60026570e9c56f9d5ab6f7dc7c1ebc800132129e2df67e8c3c770b380cc908cf8fa971b0b72a16be635c71cf45e72152aa183fd97327a60fd9a62d
-
SSDEEP
1536:NGgJzR5hgfdrAYbXlGbQ8caU6fG0e9hAD5JxPmp8YWxS6/Vs296Vs29/Cvp0Q:bV5hwdrAvQ8JU8G0evQ5JxVYWxSX0CQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 18970955f050497fa1b335c03ed39259_JaffaCakes118
Files
-
18970955f050497fa1b335c03ed39259_JaffaCakes118.exe windows:4 windows x86 arch:x86
4269618e4af00e39db329aace96b3ef5
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleFileNameA
lstrlenA
LoadLibraryA
MoveFileExA
DeleteFileA
FreeResource
LoadResource
CreateFileA
GlobalAlloc
lstrcpyA
lstrcmpiA
SetLastError
GetSystemDirectoryA
SizeofResource
Sleep
ExitProcess
CreateThread
VirtualAlloc
CloseHandle
VirtualAllocEx
VirtualProtectEx
GetModuleHandleA
GetProcAddress
WriteProcessMemory
SetThreadContext
FindResourceA
ResumeThread
TerminateProcess
CreateProcessW
GetThreadContext
ReadProcessMemory
VirtualQueryEx
GetTickCount
lstrcatA
WriteFile
user32
SendMessageA
LoadCursorA
LoadIconA
RegisterClassA
CreateWindowExA
ShowWindow
UpdateWindow
GetMessageA
TranslateMessage
DispatchMessageA
wsprintfA
DefWindowProcA
gdi32
GetStockObject
advapi32
RegOpenKeyExA
RegCloseKey
RegSetValueExA
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
StartServiceA
ChangeServiceConfigA
OpenServiceA
CloseServiceHandle
CreateServiceA
OpenSCManagerA
RegQueryValueExA
msvcrt
??2@YAPAXI@Z
fread
_strrev
ftell
fseek
fclose
fopen
memcpy
strstr
realloc
malloc
_except_handler3
strchr
strcat
strlen
Sections
.text Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.MUTI Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.mt Size: 1024B - Virtual size: 594B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 111KB - Virtual size: 110KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ