Static task
static1
Behavioral task
behavioral1
Sample
2c6456fed804908fde85e92deb4a81a1_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2c6456fed804908fde85e92deb4a81a1_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
2c6456fed804908fde85e92deb4a81a1_JaffaCakes118
-
Size
12KB
-
MD5
2c6456fed804908fde85e92deb4a81a1
-
SHA1
dd40127c0608a1ca558bf642fb37624689fdf3ff
-
SHA256
1be047c93ff1d4f687f5e379b192f6d5669efda14a97a31b3e874d2a531f14a4
-
SHA512
96e26046577b1957d8563f112353c732c7aecb0e1b666287caee590c7054510f390fbf37a50124d9cd84a0119bb5943bfa96d863f29428e3f439cc1b798c5278
-
SSDEEP
96:rFP+sV9NskIGTQFYC/2QD6PEJPUXjTmJcTCVX3IMKh5VfgjaLaGd0rGiH+G:r0sv4GTQ+CGPqrcY3IMKxSaLaGd8+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2c6456fed804908fde85e92deb4a81a1_JaffaCakes118
Files
-
2c6456fed804908fde85e92deb4a81a1_JaffaCakes118.exe windows:4 windows x86 arch:x86
e4fe6bae823ade604a2e315911afef7f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
MessageBoxA
kernel32
SizeofResource
SetCurrentDirectoryA
CloseHandle
CreateFileA
CreateFileMappingA
CreateProcessA
DeleteFileA
ExitProcess
ExpandEnvironmentStringsA
FindResourceA
GetCommandLineA
GetFileSize
LoadResource
MapViewOfFile
ReadFile
ReadProcessMemory
ResumeThread
RtlMoveMemory
lstrlenA
Sleep
TerminateProcess
UnmapViewOfFile
VirtualAlloc
VirtualFree
VirtualProtectEx
WinExec
WriteProcessMemory
lstrcatA
FindClose
FindFirstFileA
FlushFileBuffers
WriteFile
GetModuleFileNameA
GetModuleHandleA
Sections
.text Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 1024B - Virtual size: 974B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.adata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE