Static task
static1
Behavioral task
behavioral1
Sample
2874ab1ceed7f9a89f975580dde55280_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2874ab1ceed7f9a89f975580dde55280_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
2874ab1ceed7f9a89f975580dde55280_JaffaCakes118
-
Size
46KB
-
MD5
2874ab1ceed7f9a89f975580dde55280
-
SHA1
63dbfe9e3ffb27e7ea670662bf3494c7daa1018d
-
SHA256
ad1726fc1c1ff9ee41077c451b5c82acfe7161f41f594f439d6739457e45bc3b
-
SHA512
2bc1c976759239ffde38b62c7fdb4d3e62c0f3c4006de9d927a3d579f665fc6134009d4465a844fddf464b6a1c0f625c02d871de5aeecd7d7200bfdb4ea8487f
-
SSDEEP
768:yJzYzrbuViwT7/Oq6oArJ+3q2dJookhdEEBBXMYLI2Hz6+0BaItIbff/kgrnKFLV:yYXbuViwTbV6NrZEJoddTBJMY0vBIbfM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2874ab1ceed7f9a89f975580dde55280_JaffaCakes118
Files
-
2874ab1ceed7f9a89f975580dde55280_JaffaCakes118.exe windows:5 windows x86 arch:x86
2435a630d8e8d98cdc19a67e60ffc9ca
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
CryptGetHashParam
RegDeleteValueA
RegQueryValueExA
CryptReleaseContext
CryptCreateHash
DuplicateTokenEx
RegCloseKey
shlwapi
wvnsprintfA
wnsprintfA
StrStrW
PathCombineW
StrCmpNIA
PathMatchSpecW
wnsprintfW
StrCmpNIW
PathFindFileNameW
PathFileExistsW
PathRemoveFileSpecW
SHDeleteKeyA
wvnsprintfW
Sections
.oraj Size: 36KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.klab Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.udalud Size: 5KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ