Static task
static1
Behavioral task
behavioral1
Sample
302b15815306061506c972fd4344bea1_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
302b15815306061506c972fd4344bea1_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
302b15815306061506c972fd4344bea1_JaffaCakes118
-
Size
5KB
-
MD5
302b15815306061506c972fd4344bea1
-
SHA1
2c6bf7172c80da32b3952130bf3b6c22f7c58b51
-
SHA256
67e27d6487d7bf35daaa7c98b3bea0f23614eca0693dc163b19d0673a370beef
-
SHA512
6202f017cc361f57f782bdccc2956bd73d64e2c38a546ec5de39186b4759c8baec7e5d2507003484f8c71b2d9492b092f3d3bfa690da02bb0dcb0eecbe15d30f
-
SSDEEP
96:ZkPHhTktoQoJ/kdkt6SZqSCpQxU3looU11lB7Q:ZkPHIoQoJ/kdY6zQx3oY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 302b15815306061506c972fd4344bea1_JaffaCakes118
Files
-
302b15815306061506c972fd4344bea1_JaffaCakes118.exe windows:5 windows x86 arch:x86
3325a1a4fcabd2c615283d9ae29fc5b0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
RtlFreeAnsiString
RtlCompareMemory
RtlUpperString
RtlUnicodeStringToAnsiString
RtlInitUnicodeString
PsGetCurrentProcessId
ZwQueryDirectoryFile
ZwDeviceIoControlFile
IoDeleteDevice
IoDeleteSymbolicLink
wcscat
RtlFreeUnicodeString
wcscpy
RtlAnsiStringToUnicodeString
IofCompleteRequest
KeServiceDescriptorTable
IoCreateSymbolicLink
IoCreateDevice
Sections
.text Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 640B - Virtual size: 560B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 640B - Virtual size: 526B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 128B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xxx0 Size: 256B - Virtual size: 214B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.xxx1 Size: 128B - Virtual size: 76B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.reloc Size: 256B - Virtual size: 180B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ