Static task
static1
Behavioral task
behavioral1
Sample
31688381d1d4f89916c3dfde5b57e46b_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
31688381d1d4f89916c3dfde5b57e46b_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
31688381d1d4f89916c3dfde5b57e46b_JaffaCakes118
-
Size
401KB
-
MD5
31688381d1d4f89916c3dfde5b57e46b
-
SHA1
2b9697e042cb07db07677fc7d4bd29d4f09724be
-
SHA256
ca40cbd302b4a63d3b72898769c325232c44003c1b73ec2f3d84b952c2d8c59b
-
SHA512
5096b9d871fd8f28db6d35a06806a96a07a3485efad8eb4e27aad72a8a234a34371a23823979c288af65a01e075e7caf4c68ad95a4f4561415336c74056ca378
-
SSDEEP
6144:aHRgptQXuqDYjvUdelv+z+Yk1H5NrwzVXrD6NWk8ux6oWqBrqfhkkwUf1j:POOGEG9iNr6rD6kU6srqfSbG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 31688381d1d4f89916c3dfde5b57e46b_JaffaCakes118
Files
-
31688381d1d4f89916c3dfde5b57e46b_JaffaCakes118.exe windows:4 windows x86 arch:x86
23aec78b64844634ce372f944da5a3e3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
InterlockedDecrement
GetLastError
LeaveCriticalSection
HeapAlloc
WaitForMultipleObjects
GlobalFree
Sleep
CreateThread
BindIoCompletionCallback
VirtualAlloc
SetEvent
GlobalAlloc
FileTimeToSystemTime
EnterCriticalSection
HeapDestroy
CreateEventA
LoadLibraryA
ExitProcess
HeapFree
HeapCreate
FreeLibraryAndExitThread
GetModuleFileNameA
GetTickCount
user32
CallMsgFilterA
ntdll
wcslen
wcscpy
RtlQueryRegistryValues
RtlQueueWorkItem
RtlUnwind
rtutils
TraceRegisterExA
TraceVprintfExA
TraceDeregisterA
RouterLogEventA
RouterLogRegisterA
RouterLogDeregisterA
RouterLogEventDataW
msi
MsiDatabaseExportW
shlwapi
StrCatBuffW
rtm
RtmCreateEnumerationHandle
RtmDeregisterClient
RtmCloseEnumerationHandle
RtmIsRoute
RtmBlockDeleteRoutes
RtmDeleteRoute
RtmAddRoute
RtmRegisterClient
RtmGetFirstRoute
RtmDequeueRouteChangeMessage
RtmEnumerateGetNextRoute
cfgmgr32
CM_Next_Range
CM_Get_Version
wmi
WmiNotificationRegistrationW
Sections
.text Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 240KB - Virtual size: 240KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 140KB - Virtual size: 140KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 2.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ