Static task
static1
Behavioral task
behavioral1
Sample
279c14c9d6307c7021846f45cfa80c90_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
279c14c9d6307c7021846f45cfa80c90_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
279c14c9d6307c7021846f45cfa80c90_JaffaCakes118
-
Size
160KB
-
MD5
279c14c9d6307c7021846f45cfa80c90
-
SHA1
a6328dc07eed96242ccb6c531a93dd9fc328f815
-
SHA256
25141663464328bc90ecece565718f7542bb205c04a7b8085da056979c24ebeb
-
SHA512
1353f277bdb9ec7ddd473092e981f50065fa82d361fd4ac1d18da821ac6bdba1c2794e1d353e535b221809315167a3345b54d3bf9566ee36cf9d32332a3c74d8
-
SSDEEP
3072:yLefQvuyY55mUA+OuS7NnClNLwVgSYI+cm+7yKv3SLlaJ9DMysZ:BXJA1l48VgnI+kyfW94F
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 279c14c9d6307c7021846f45cfa80c90_JaffaCakes118
Files
-
279c14c9d6307c7021846f45cfa80c90_JaffaCakes118.exe windows:4 windows x86 arch:x86
fce7809a30096dee5d325be7178490ba
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateProcessA
ExitProcess
FindResourceA
GetModuleFileNameA
GetThreadContext
GetTickCount
LoadResource
LockResource
ReadProcessMemory
ResumeThread
SetThreadContext
SizeofResource
Sleep
VirtualAlloc
VirtualAllocEx
VirtualFree
WriteProcessMemory
Sections
Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 154KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 77B - Virtual size: 256B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE