Static task
static1
Behavioral task
behavioral1
Sample
2d7abeaa8a765f0434607ec4cbc145f4_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2d7abeaa8a765f0434607ec4cbc145f4_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
2d7abeaa8a765f0434607ec4cbc145f4_JaffaCakes118
-
Size
72KB
-
MD5
2d7abeaa8a765f0434607ec4cbc145f4
-
SHA1
3ac8351de3a81b9d55d05a3c51fedb5bf523e5c1
-
SHA256
9cde4808ff9a67442f1095d43bb612b5afc111143cd1334e0f4b10920218c419
-
SHA512
c189e60de2b1ed4cf6faf06486894b7eb9b90e2d3589ff9db56c48212e60d11bb1f7fc7f69d1d73b9c4f0bfbbb31d8542185cc9073d6df8c7e015525094e115b
-
SSDEEP
1536:mGmV1u5JeoOSlJK1Rzgg39UW2Qb7SCJkNpujl29:mGmVqBSz13hXIpujl29
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2d7abeaa8a765f0434607ec4cbc145f4_JaffaCakes118
Files
-
2d7abeaa8a765f0434607ec4cbc145f4_JaffaCakes118.exe windows:4 windows x86 arch:x86
fe50123e8467bfa4378f273664428114
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleA
GetSystemTimeAsFileTime
FlushFileBuffers
SetStdHandle
GetCurrentThreadId
GetLastError
Sleep
GetModuleFileNameA
GetFileInformationByHandle
GetPrivateProfileStringA
MapViewOfFile
GetShortPathNameA
GetCompressedFileSizeA
SetFileAttributesA
CreateProcessA
CreateDirectoryA
LoadLibraryA
GetProcAddress
FreeLibrary
GetWindowsDirectoryA
GetVersionExA
CloseHandle
CreateToolhelp32Snapshot
Process32First
Process32Next
OpenProcess
WideCharToMultiByte
RaiseException
RtlUnwind
HeapFree
GetCommandLineA
HeapAlloc
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetCPInfo
ExitProcess
TerminateProcess
GetCurrentProcess
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
SetUnhandledExceptionFilter
HeapReAlloc
HeapSize
HeapDestroy
HeapCreate
VirtualFree
IsBadWritePtr
GetACP
GetOEMCP
WriteFile
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
IsBadReadPtr
IsBadCodePtr
InterlockedExchange
SetFilePointer
advapi32
RegisterServiceCtrlHandlerA
RegSetKeySecurity
RegSetValueA
RegQueryValueA
StartServiceCtrlDispatcherA
SetServiceStatus
ControlService
DeleteService
StartServiceA
QueryServiceStatus
CreateServiceA
ChangeServiceConfig2A
RegCreateKeyA
RegSetValueExA
RegCloseKey
OpenSCManagerA
OpenServiceA
CloseServiceHandle
DeregisterEventSource
RegQueryValueExA
GetUserNameA
CreateProcessAsUserA
OpenProcessToken
Sections
.text Size: 44KB - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 880B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ