Static task
static1
Behavioral task
behavioral1
Sample
30de6c34496b29e46be280cc5f34c735_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
30de6c34496b29e46be280cc5f34c735_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
30de6c34496b29e46be280cc5f34c735_JaffaCakes118
-
Size
162KB
-
MD5
30de6c34496b29e46be280cc5f34c735
-
SHA1
e79653faa537662e5fed42d930e889cfc8887259
-
SHA256
4433419d52b00d84457d589651cd3ae38dcbdba1c574625f6b6595e306149988
-
SHA512
01d6fc0f75f3e574597e0b0c4e0bbdb102683aa1646fdc01ec67cbfc991f3fb2acd932363bda452ba13755a140f334633a9770823b7cd93b1d779cd93e3f0087
-
SSDEEP
3072:+GbUuhBrFQWwa7GwHR6eSYQb3ojWVpYYv5V4lyXPtdcJn+OdZq1m:+ioa7Gwx61YQ7RVVwEcJn+oZKm
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 30de6c34496b29e46be280cc5f34c735_JaffaCakes118
Files
-
30de6c34496b29e46be280cc5f34c735_JaffaCakes118.exe windows:5 windows x86 arch:x86
8f3be410e562b9de8ad5fc60d9c08545
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
_except_handler3
exit
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__initenv
_cexit
_XcptFilter
_exit
_c_exit
setlocale
wcslen
qsort
strchr
_ftol
wcscoll
_wcsicoll
strcoll
_stricoll
atoi
_strnicmp
_iob
fprintf
advapi32
IsTextUnicode
kernel32
WideCharToMultiByte
GetTempPathA
GetTempFileNameA
GetDiskFreeSpaceA
WriteFile
CloseHandle
ResetEvent
ReadFile
GetOverlappedResult
GlobalMemoryStatusEx
GetSystemInfo
GetCPInfo
WaitForSingleObject
GetStdHandle
CreateFileA
GetFileType
GetFileSize
GetConsoleMode
CreateEventA
MultiByteToWideChar
GetProcessHeap
HeapAlloc
HeapFree
GetLastError
GetModuleHandleA
FormatMessageA
VirtualAlloc
ntdll
RtlMultiByteToUnicodeN
RtlUnicodeToOemN
Sections
.text Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 75KB - Virtual size: 128KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 57KB - Virtual size: 156KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE