Static task
static1
Behavioral task
behavioral1
Sample
1b5f179c303fd9ae6cb740fcc6cab1fa_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1b5f179c303fd9ae6cb740fcc6cab1fa_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
1b5f179c303fd9ae6cb740fcc6cab1fa_JaffaCakes118
-
Size
218KB
-
MD5
1b5f179c303fd9ae6cb740fcc6cab1fa
-
SHA1
15c66df72edf3e1b71224956c2eb7be92aa1676f
-
SHA256
be5455cab50d9defe85bd25e9fea9dc45cb7e6de331a1fb20ea352df8f486120
-
SHA512
336789421795d5fc56a569d716f1051d78139e11e7686612d3b69d2c2cd8b37a8804b77c9d0f72f6ac4163525928bee6ec19b0374edd67b1332c6f828c2bc56f
-
SSDEEP
3072:Gt+lUMhlpK+rhhufizxBA4wy9w8yTniqv4CyPvwIDbKlNISfxK9luz:Kp+PufizxW49K8SvwTU5N
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1b5f179c303fd9ae6cb740fcc6cab1fa_JaffaCakes118
Files
-
1b5f179c303fd9ae6cb740fcc6cab1fa_JaffaCakes118.exe windows:1 windows x86 arch:x86
890de56b59d4d16e481c0c31b5b6e52a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FormatMessageW
ReadFile
CloseHandle
EnterCriticalSection
GetModuleHandleA
GetProcessHeap
MultiByteToWideChar
GetCommandLineW
TerminateProcess
GetACP
WideCharToMultiByte
TerminateProcess
GetCurrentProcessId
GetCurrentProcessId
FormatMessageW
GetModuleFileNameA
LocalAlloc
SetLastError
VirtualAlloc
HeapReAlloc
VirtualAlloc
InterlockedDecrement
DeleteCriticalSection
GetCommandLineW
GetLastError
GetCurrentThreadId
ExitProcess
FormatMessageW
LoadLibraryA
CreateFileW
HeapAlloc
GetCurrentProcessId
lstrcpyW
LocalFree
HeapReAlloc
InterlockedDecrement
HeapAlloc
lstrlenW
LocalFree
TerminateProcess
UnhandledExceptionFilter
ExitProcess
VirtualAlloc
GetACP
HeapAlloc
WideCharToMultiByte
GetProcAddress
SetEvent
CreateThread
Sections
.text Size: 211KB - Virtual size: 344KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.idata Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.reloc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE