Static task
static1
Behavioral task
behavioral1
Sample
2305913cbf5158d9b4c5724b4c82193e_JaffaCakes118.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
2305913cbf5158d9b4c5724b4c82193e_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
2305913cbf5158d9b4c5724b4c82193e_JaffaCakes118
-
Size
18KB
-
MD5
2305913cbf5158d9b4c5724b4c82193e
-
SHA1
1adf5fbb6eabb2bfe9762de73b666a529442ef74
-
SHA256
264346e9c19aa05783e07ef22644a621c16b47263ddae1b7f6ee457cd9b9ae07
-
SHA512
28278a0f30e807394075aa579950b1cfc8027460f2d804b6ff30ef26f67dacaca7662806a83177946f55771d46537fd4c429b51b185874237099f807e96509a5
-
SSDEEP
384:a9nHvWRnVL1Q41/fKN+jKSJkaX8avXspszOPlcusJ3Ahsr+:2gnVBTFfKN2BdvjzOPljsl6sr+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2305913cbf5158d9b4c5724b4c82193e_JaffaCakes118
Files
-
2305913cbf5158d9b4c5724b4c82193e_JaffaCakes118.exe windows:4 windows x86 arch:x86
b8f8579b2dd41ffb53abd1fd63bea584
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Process32Next
Process32First
CreateToolhelp32Snapshot
GetCurrentProcess
WinExec
GetCurrentProcessId
CopyFileA
DeleteFileA
WaitForSingleObject
TerminateProcess
OpenProcess
GetCommandLineA
CloseHandle
GetModuleFileNameA
GetTempPathA
CreateRemoteThread
GlobalLock
GlobalAlloc
WriteProcessMemory
VirtualAllocEx
GetProcAddress
LoadLibraryA
GetStartupInfoA
GetModuleHandleA
FindResourceA
VirtualProtectEx
SizeofResource
LoadResource
LockResource
Sleep
CreateThread
user32
FindWindowExA
FindWindowA
SendMessageA
advapi32
RegOpenKeyExA
RegCloseKey
RegSetValueExA
winmm
mixerSetControlDetails
mixerGetLineControlsA
mixerGetLineInfoA
mixerOpen
msvcrt
strlen
_controlfp
_except_handler3
__set_app_type
memcpy
memset
fclose
fseek
fwrite
fopen
sprintf
strncpy
sscanf
strchr
strcpy
strrchr
_stricmp
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
Sections
.text Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 412B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ