Static task
static1
Behavioral task
behavioral1
Sample
1ba208db456519c08ab084f53dda2b0d_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
1ba208db456519c08ab084f53dda2b0d_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
1ba208db456519c08ab084f53dda2b0d_JaffaCakes118
-
Size
84KB
-
MD5
1ba208db456519c08ab084f53dda2b0d
-
SHA1
d66dea3594fc26a3df4dab4c8172df701fb7ba42
-
SHA256
6e78df5c5dc4113ec93293315f08ecc9578f2949669feae09d84015ca4368941
-
SHA512
16083d750b4077a80350b1884c1e7537c8f4c1e184d561d09da38a20c7c856888c21f563b22f973052b2b6490c3e4d15fe8ed9d2a148c70714108ac57b094ca1
-
SSDEEP
1536:yBbklkTeYQXUAUSDWVlwfnfAiu63GuJq0ZTqtC7ntHKsaY3A/HB:4kdXFjWVlEAl0fJq0ZTq87n1KsBk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1ba208db456519c08ab084f53dda2b0d_JaffaCakes118
Files
-
1ba208db456519c08ab084f53dda2b0d_JaffaCakes118.exe windows:4 windows x86 arch:x86
1f03b4d21ede764fa0f496bfe98d3318
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrlenA
GetProcAddress
LoadLibraryA
Sleep
GetSystemTimeAsFileTime
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetCurrentThreadId
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
GetLastError
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
WriteFile
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
HeapAlloc
VirtualAlloc
HeapReAlloc
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
InterlockedDecrement
InterlockedIncrement
Sections
.text Size: 20KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 52KB - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ