Static task
static1
Behavioral task
behavioral1
Sample
2a3f84122b32b3984613ad91c50c6ac8_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2a3f84122b32b3984613ad91c50c6ac8_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
2a3f84122b32b3984613ad91c50c6ac8_JaffaCakes118
-
Size
148KB
-
MD5
2a3f84122b32b3984613ad91c50c6ac8
-
SHA1
4caf24f45ece427086c43987c7721b87c332e751
-
SHA256
8044d3269a51966478c5f67011bdce4fe67f04dc1069ae7cf9dcf1c747fbbb07
-
SHA512
16d59761b687a92da623fe3283598e0e0dd0c9c69bb86ea6d5e687713b542a7777b636d0ff0cc38d7c7c9a1b765f655952a32a99fc776e33e32f5af1d8b89ea0
-
SSDEEP
1536:3fiJmFlVVrad7GupS2aGkYuxK9LJ6Zj+AoSkEHTtFgJvTkWJ2PBlwom85fqjcc+n:3a8RVrBupofggwCBlwom85qcTkWSddq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2a3f84122b32b3984613ad91c50c6ac8_JaffaCakes118
Files
-
2a3f84122b32b3984613ad91c50c6ac8_JaffaCakes118.exe windows:4 windows x86 arch:x86
d54912d2fb8ae3f821e2cb08c3de3615
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CopyFileA
GetModuleFileNameA
GetSystemDirectoryA
GlobalFree
CloseHandle
WriteFile
CreateFileA
lstrcatA
LockResource
GlobalAlloc
LoadResource
SizeofResource
LoadLibraryA
GetStringTypeA
SetEndOfFile
GetOEMCP
GetACP
GetCPInfo
ReadFile
FlushFileBuffers
SetStdHandle
HeapReAlloc
VirtualAlloc
RtlUnwind
FindResourceA
GetProcAddress
VirtualFree
HeapCreate
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
HeapFree
GetLastError
TerminateProcess
GetCurrentProcess
SetFilePointer
HeapAlloc
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
LCMapStringW
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
GetStringTypeW
user32
DefWindowProcA
PostQuitMessage
LoadCursorA
LoadIconA
CreateWindowExA
ShowWindow
UpdateWindow
GetMessageA
TranslateMessage
DispatchMessageA
RegisterClassA
gdi32
GetStockObject
shell32
ShellExecuteA
Sections
Size: 144KB - Virtual size: 144KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE