Static task
static1
Behavioral task
behavioral1
Sample
2adae0a577c85a86623f3ba7b64f1df9_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2adae0a577c85a86623f3ba7b64f1df9_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
2adae0a577c85a86623f3ba7b64f1df9_JaffaCakes118
-
Size
345KB
-
MD5
2adae0a577c85a86623f3ba7b64f1df9
-
SHA1
5ab2dea0ca031f0ebaa070c6fbffb55497fea435
-
SHA256
cab13cec2abc8419bdf918c14f483f23b51b95bdc39185436318b5b4959b9ba6
-
SHA512
c1fce8b8881b467e48adce90548be937272d3e8e7f42bbe16ed15a33adfe7865fde33cf6fcd0c132fd7ac580c57bd18042657d5274863849d66a110d8df09fbb
-
SSDEEP
6144:DD1TsCHwtdOt+VaI7ztYx1/YnZCSc72aqGLPrRySHh/h11xX+neM6cb:DR4CQtot+VNZYxxyHcKfGLPr8SHh/lxG
Malware Config
Signatures
Files
-
2adae0a577c85a86623f3ba7b64f1df9_JaffaCakes118.exe windows:4 windows x86 arch:x86
2c35ed123bf7fb5532653325910c7a41
Code Sign
c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate
IssuerCN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft CorporationNot Before10-01-1997 07:00Not After31-12-2020 07:00SubjectCN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporationc1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate
IssuerCN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft CorporationNot Before10-01-1997 07:00Not After31-12-2020 07:00SubjectCN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation61:47:52:ba:00:00:00:00:00:04Certificate
IssuerCN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before16-09-2006 01:53Not After16-09-2011 02:03SubjectCN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
61:47:52:ba:00:00:00:00:00:04Certificate
IssuerCN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before16-09-2006 01:53Not After16-09-2011 02:03SubjectCN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2Certificate
IssuerCN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft CorporationNot Before16-09-2006 01:04Not After15-09-2019 07:00SubjectCN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
61:02:30:7e:00:00:00:00:00:06Certificate
IssuerCN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before10-03-2008 21:57Not After10-06-2009 22:07SubjectCN=Microsoft Windows Component Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
6a:0b:99:4f:c0:00:1b:ab:11:da:3a:a1:b6:df:ec:88Certificate
IssuerCN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft CorporationNot Before11-10-2005 21:55Not After26-04-2010 07:00SubjectCN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign
ed:69:fc:48:72:7e:a3:af:12:46:f5:04:b9:4e:70:97:71:d6:12:cfSigner
Actual PE Digested:69:fc:48:72:7e:a3:af:12:46:f5:04:b9:4e:70:97:71:d6:12:cfDigest Algorithmsha1PE Digest MatchesfalseHeaders
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetProcAddress
LoadLibraryA
GetModuleHandleA
VirtualAlloc
VirtualFree
Sections
CODE Size: 327KB - Virtual size: 704KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Xmini9 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.llydd Size: 7KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE