Static task
static1
Behavioral task
behavioral1
Sample
18f123c8c445c6a781173d073626f0c2_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
18f123c8c445c6a781173d073626f0c2_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
18f123c8c445c6a781173d073626f0c2_JaffaCakes118
-
Size
250KB
-
MD5
18f123c8c445c6a781173d073626f0c2
-
SHA1
cc6b33e5c30ac28d8ed5caeaa3117c7215a2c88f
-
SHA256
7c92ca4757f25d659b13c7a3e1f5b75ec9fb6f7b7f51315d82d175011fb16e9b
-
SHA512
672e8b385e15b0eadbbe03ed9825ad7cbcd696ab6d073c7d15b54f3bf594f877780baebe85a03cd29a7497782857103432e7acbfcd93faf8c50931abd69dadc9
-
SSDEEP
6144:L9aL+TmziO5hMpMGcWkOICB4F00XFVjJlyby9MMMMMMfMMMMh:O+CziO5hMmG7tBYJlybyD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 18f123c8c445c6a781173d073626f0c2_JaffaCakes118
Files
-
18f123c8c445c6a781173d073626f0c2_JaffaCakes118.exe windows:4 windows x86 arch:x86
b71fac9fa2abc955f53fe9d262972eb6
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mapi32
ord137
ord140
ord75
ord17
ord136
kernel32
GetCurrentThreadId
GetCurrentProcessId
GetModuleFileNameW
IsBadReadPtr
InitializeCriticalSection
Sleep
RaiseException
TlsAlloc
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
GetCurrentProcess
GetTickCount
CreateMutexW
GetProcAddress
LoadLibraryA
advapi32
RegEnumKeyExW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
ole32
CoCreateInstance
inseng
DownloadFile
PurgeDownloadDirectory
GetICifRWFileFromFile
rnr20
NSPStartup
Sections
.text Size: 11KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.edata Size: 2KB - Virtual size: 377KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 1024B - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
CODE Size: 101KB - Virtual size: 117KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 2KB - Virtual size: 372KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.aspack Size: 119KB - Virtual size: 210KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ