Static task
static1
Behavioral task
behavioral1
Sample
1c4eb127aab34f1411fd374b6b23a58a_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
1c4eb127aab34f1411fd374b6b23a58a_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
1c4eb127aab34f1411fd374b6b23a58a_JaffaCakes118
-
Size
44KB
-
MD5
1c4eb127aab34f1411fd374b6b23a58a
-
SHA1
bdb91b9130e3c8c0fbb77943adffb781f8865cb7
-
SHA256
e5978f33aca8bcd55a20d812d5ab31b065dfd7ace89ae356ec756a168ebe1a5a
-
SHA512
8152bb0b52ce7346563d8e92b12fdbe4a049f3c61ce721f929041010b424fb9f40a6e41083ff4878f0cbae986d37490802479401bb6a25e40b0eb106a48ec6ab
-
SSDEEP
384:aJxsmlLV+VJ0npLPgIyyvmrhqmlotShPZJy5uxif7TweUpGDBeqYx:aJxYVJ0lyumrhnloAnJyfvMXx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1c4eb127aab34f1411fd374b6b23a58a_JaffaCakes118
Files
-
1c4eb127aab34f1411fd374b6b23a58a_JaffaCakes118.exe .vbs windows:4 windows x86 arch:x86 polyglot
80729d9c681fd2873c2efd4c41a64c84
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ExitProcess
WaitForSingleObject
CreateProcessA
WriteFile
CreateFileA
GetModuleFileNameA
lstrcmpA
LockResource
LoadResource
FindResourceA
GetTempPathA
CloseHandle
DuplicateHandle
GetCurrentProcess
SetStdHandle
CreatePipe
GetStdHandle
GetModuleHandleA
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
HeapAlloc
GetCommandLineA
GetVersion
DeleteFileA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
VirtualAlloc
HeapReAlloc
TerminateProcess
LoadLibraryA
MultiByteToWideChar
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
RtlUnwind
GetCPInfo
GetACP
GetOEMCP
GetProcAddress
user32
GetForegroundWindow
MessageBoxA
LoadStringA
shlwapi
StrToIntA
Sections
.text Size: 16KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ