Static task
static1
Behavioral task
behavioral1
Sample
1b1aa5980c22310420eb7c428c93e759_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1b1aa5980c22310420eb7c428c93e759_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
1b1aa5980c22310420eb7c428c93e759_JaffaCakes118
-
Size
112KB
-
MD5
1b1aa5980c22310420eb7c428c93e759
-
SHA1
d29978b2bedaf00908649387c9f546636573b3ad
-
SHA256
2bd0d5010a698cb6c58e11a2635fa9885aea3d3915f66b7026b4b6fdd83820a2
-
SHA512
086a675028c456d7a89c117c8e053df15a0ee50b160fd19b4420a32ae375b5dc3fbedbb22b0edcda92ff1098662658248e7877a0c4291da628abb07f0ef2735e
-
SSDEEP
3072:0GJ6VVLD41UXhXpYuc8IJodk+GOi18N96Tde2pArf:QDXUu7xHi18N8Nez
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1b1aa5980c22310420eb7c428c93e759_JaffaCakes118
Files
-
1b1aa5980c22310420eb7c428c93e759_JaffaCakes118.exe windows:4 windows x86 arch:x86
4896f5f2accfa95f14abceaa678e5ecb
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegOpenKeyExA
RegQueryValueExA
RegEnumKeyA
RegCloseKey
user32
MessageBoxA
msvcrt
malloc
fclose
fwrite
fread
fopen
perror
strspn
strcspn
fgets
strchr
strrchr
__p___argc
__p___argv
__initenv
getenv
_putenv
memmove
strncmp
free
_isctype
sprintf
calloc
_exit
_XcptFilter
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
printf
exit
_iob
fprintf
strpbrk
_pctype
__p__environ
__mb_cur_max
_strnicmp
_stricmp
_strdup
_stat
_spawnv
_read
_close
_open
_lseek
kernel32
GetStartupInfoA
QueryPerformanceFrequency
GetSystemDefaultLCID
SetThreadLocale
GetModuleHandleA
GetModuleFileNameA
LoadLibraryA
GetProcAddress
QueryPerformanceCounter
Sections
.text Size: 24KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.wrdata Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE