Static task
static1
Behavioral task
behavioral1
Sample
2c891c62fd24af6079377f898eec88cb_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2c891c62fd24af6079377f898eec88cb_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
2c891c62fd24af6079377f898eec88cb_JaffaCakes118
-
Size
95KB
-
MD5
2c891c62fd24af6079377f898eec88cb
-
SHA1
ced76cfb1a01ca354825123e266509a161ab13ee
-
SHA256
1253b019044261b029a253134036d5e78160ecfd5f30277e0012a36aa29fe940
-
SHA512
59ca8b967cef727bbc9f5ec4a2af26cac136ec2a333a3cb0a623d6ea8ac46b3ac4d01945c062be3575cf26d2afc74f6f78726eb99bc3bcb0d78505a9b4642ed8
-
SSDEEP
1536:E7DO8uFTt5bjIQXksZwj6H0yfKK3DwC+/sjLajt3XAm4Q2QthtR4+y8Al8tedM+3:En3MBZjIQXfSMX/VLajVUQNt5nyjl8tq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2c891c62fd24af6079377f898eec88cb_JaffaCakes118
Files
-
2c891c62fd24af6079377f898eec88cb_JaffaCakes118.exe windows:4 windows x86 arch:x86
43a36f1a0c1f101c0df3d0fc8a77d5bf
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCurrentProcess
GetTickCount
InterlockedExchangeAdd
GetCurrentThreadId
InterlockedIncrement
InterlockedExchange
QueryPerformanceCounter
InterlockedDecrement
GetACP
GetCurrentThread
Sleep
HeapAlloc
GetProcessHeap
HeapDestroy
HeapFree
HeapCreate
ExitProcess
VirtualAlloc
VirtualProtect
VirtualFree
GetProcAddress
HeapReAlloc
LoadLibraryA
IsBadReadPtr
lstrcmpiA
FreeLibrary
SizeofResource
LockResource
LoadResource
FindResourceA
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
Sections
.text Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 1024B - Virtual size: 888B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.krdata Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE