Static task
static1
Behavioral task
behavioral1
Sample
2baaab33bf91463434ce3ce585eec73b_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2baaab33bf91463434ce3ce585eec73b_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
2baaab33bf91463434ce3ce585eec73b_JaffaCakes118
-
Size
23KB
-
MD5
2baaab33bf91463434ce3ce585eec73b
-
SHA1
765b5015e64d871b162453f9e077213afe9ae267
-
SHA256
b07fd60258700d007aaa8dcf6a927bafdc2482b921cbf766f2f7a32e586c19f5
-
SHA512
bbb6c87fc0a94d6a38eecce97d21eb1bb3e7cf9a50c5220353e615ada678763cc02fe88e95c93e91c02f1e93c6b9d83a0e4a64cc1b7b0fd87583f80c6404bf82
-
SSDEEP
384:STn+Rp8pY7U11shgBjemIoZ7o42WDNkm/URvagHDRwlfDBGWW0+QAOYsZPQ:dpW2m1sYqDqo42WhkYa1HDRQhW0R4sQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2baaab33bf91463434ce3ce585eec73b_JaffaCakes118
Files
-
2baaab33bf91463434ce3ce585eec73b_JaffaCakes118.exe windows:4 windows x86 arch:x86
6a368c7abc6384cf09e2a2845acb6b97
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
Module32Next
Module32First
CreateToolhelp32Snapshot
GetCurrentProcessId
GetProcAddress
GetModuleHandleA
ReadFile
GetFileSize
CreateFileA
Sleep
ExitProcess
GetModuleFileNameA
CreateThread
CreateMutexA
OpenMutexA
GetStartupInfoA
msvcrt
malloc
_except_handler3
free
realloc
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
strstr
Sections
.Text Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Rdata Size: 1024B - Virtual size: 924B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 308B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
SISCrypt Size: 316B - Virtual size: 316B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE