Static task
static1
Behavioral task
behavioral1
Sample
2125b435e065ed4576810a64e5f50293_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2125b435e065ed4576810a64e5f50293_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
2125b435e065ed4576810a64e5f50293_JaffaCakes118
-
Size
54KB
-
MD5
2125b435e065ed4576810a64e5f50293
-
SHA1
0d2906bd8fbd0f4140384bbc3ffaafae21a8ddbd
-
SHA256
8d65dee17a45e8f144df50cbfab6a12010ed5db34b0447c3e15729608827dab2
-
SHA512
9795cfc994bf494fd00488336a26161ed8e5ef59df77522d90b34b1c5a0d6a3368331a674448cc86ccaae5816de2ea3abfb946c384e1d59e65d40a0a75f1cdc4
-
SSDEEP
1536:poMB4oy7pkr6C+RYWTORUI5DODt8PqPmI:GMVTWSOt8Pq+I
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2125b435e065ed4576810a64e5f50293_JaffaCakes118
Files
-
2125b435e065ed4576810a64e5f50293_JaffaCakes118.exe windows:4 windows x86 arch:x86
3b8330ff3fe7bb21a7124c9859dcb7fb
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetProcessWorkingSetSize
WaitForSingleObject
GetShortPathNameA
WinExec
GetProcessId
GetTempFileNameA
GetBinaryTypeA
CreateFileA
GetFileSize
SetFilePointer
ReadFile
CreateProcessA
RtlMoveMemory
GetModuleHandleA
ExitProcess
HeapReAlloc
HeapFree
IsBadReadPtr
GetTickCount
FreeLibrary
GetProcAddress
LoadLibraryA
LCMapStringA
GetTempPathA
MoveFileExA
Sleep
RtlFillMemory
HeapAlloc
GetProcessHeap
CloseHandle
OpenProcess
GetOEMCP
DeleteFileA
lstrlen
CreateMutexA
lstrcpynA
OpenMutexA
psapi
EnumProcesses
GetModuleFileNameExA
shlwapi
PathFindFileNameA
PathFileExistsA
user32
wvsprintfA
FindWindowA
PostMessageA
wsprintfA
MessageBoxA
GetAncestor
GetWindowTextA
EnumChildWindows
GetWindowThreadProcessId
EnumWindows
WaitForInputIdle
ShowWindow
urlmon
URLDownloadToFileA
shell32
SHGetSpecialFolderPathA
ShellExecuteEx
SHFileOperationA
wininet
InternetOpenA
InternetOpenUrlA
InternetCloseHandle
InternetReadFile
iphlpapi
GetAdaptersInfo
advapi32
CryptAcquireContextA
RegDeleteValueA
RegDeleteKeyA
RegSetValueExA
RegCreateKeyA
RegCloseKey
RegQueryValueExA
RegOpenKeyA
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptReleaseContext
CryptCreateHash
msvcrt
rand
srand
tolower
_strnicmp
strncmp
??3@YAXPAX@Z
sprintf
_CIfmod
atoi
_ftol
strchr
memmove
modf
free
malloc
strncpy
Sections
.text Size: 46KB - Virtual size: 45KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE