Static task
static1
Behavioral task
behavioral1
Sample
2da1e117f5120eebc5a0fa3445476bd6_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2da1e117f5120eebc5a0fa3445476bd6_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
2da1e117f5120eebc5a0fa3445476bd6_JaffaCakes118
-
Size
68KB
-
MD5
2da1e117f5120eebc5a0fa3445476bd6
-
SHA1
6f267a7d7c97f41c7cef0864b89b91292162f167
-
SHA256
f58920a84ca5a774ad3ae483d938546fdc4a75ede6b3e57381007fc2b1df6c0f
-
SHA512
6e0bbf0624e612d5c61ffa31ce2492ce3a5389385cc50a365128cfaf81133b874d2bcfaa76d4d1bef12314ad5f6cc7ef328108edd80a7ad31df36b0b0e53fe6a
-
SSDEEP
768:faWjzyOeQsXFmvlJXN0hNDu1T2dryZj7xkYedDWRYqFWC9onb6Tj/o1iD:flyOeFXFmxkNk22jDed5q0Bb6vo1iD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2da1e117f5120eebc5a0fa3445476bd6_JaffaCakes118
Files
-
2da1e117f5120eebc5a0fa3445476bd6_JaffaCakes118.exe windows:4 windows x86 arch:x86
6d1eb0d973edf1eaa78c9b0b4ee68dea
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
OpenEventA
SetEvent
CloseHandle
GetStringTypeA
LCMapStringW
RtlUnwind
GetCommandLineA
GetVersion
ExitProcess
HeapFree
RaiseException
HeapAlloc
HeapReAlloc
TerminateProcess
GetCurrentProcess
HeapSize
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleHandleA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
WriteFile
VirtualAlloc
IsBadWritePtr
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
GetCPInfo
GetACP
GetOEMCP
GetProcAddress
LoadLibraryA
MultiByteToWideChar
LCMapStringA
GetStringTypeW
advapi32
RegCreateKeyExA
RegDeleteKeyA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
RegSetValueExA
Sections
.text Size: 44KB - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE