Static task
static1
Behavioral task
behavioral1
Sample
2d81e78ffe1ff71583a11fc3c4479123_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2d81e78ffe1ff71583a11fc3c4479123_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
2d81e78ffe1ff71583a11fc3c4479123_JaffaCakes118
-
Size
43KB
-
MD5
2d81e78ffe1ff71583a11fc3c4479123
-
SHA1
45e51108949235afda41ce9028f1a528b4b269dd
-
SHA256
dff2d448f22fc9a4dcd6a7ec979e6966d67e86e5dca009bee796c6ad3d63c09a
-
SHA512
494d1b54a43a918537045bc1e5a370be20757626736fd3013021edeb2a6aaf1d885b414f4008dace9f26d0d74a4022364d2acd5e961fb35a0473e9548867cfc1
-
SSDEEP
768:/HnhAJiZx1JKz2pD6Rz2Fyu3xaNcahM0PJPw2:/Hh061KCR6Rz2FyuhJahnPJP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2d81e78ffe1ff71583a11fc3c4479123_JaffaCakes118
Files
-
2d81e78ffe1ff71583a11fc3c4479123_JaffaCakes118.exe windows:4 windows x86 arch:x86
8c69efc1845214bdb3c26bb3ec7e741d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntdll
RtlRandom
atoi
strstr
_itoa
sprintf
_stricmp
memcpy
memset
kernel32
DeleteFileA
CloseHandle
VirtualProtect
GetModuleHandleA
CreateFileA
FreeLibrary
HeapAlloc
HeapFree
GetTickCount
VirtualFree
GetProcessHeap
IsBadReadPtr
ExpandEnvironmentStringsA
GetModuleFileNameA
Sleep
SetCurrentDirectoryA
GetLastError
GetProcAddress
VirtualAlloc
CopyFileA
LoadLibraryA
WriteFile
advapi32
ControlService
OpenSCManagerA
OpenServiceW
CloseServiceHandle
Sections
.text Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 36KB - Virtual size: 54KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE