Static task
static1
Behavioral task
behavioral1
Sample
36a6e6471f711b0486dbc1bc9d8f5358_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
36a6e6471f711b0486dbc1bc9d8f5358_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
36a6e6471f711b0486dbc1bc9d8f5358_JaffaCakes118
-
Size
63KB
-
MD5
36a6e6471f711b0486dbc1bc9d8f5358
-
SHA1
158ab6ae5f099a5f6370660e14cbee7e3da6758f
-
SHA256
b99504ba60bc2877433dea5a871591f0d20f58786fcf5bed22ce673dff76d401
-
SHA512
4ef67949dcbf7bf71b677511e2958ced6138be316724da74ad0c6d1d3b3e09621be26e0c382db2a112fe059ec57b9737ff32b7f1b0b98f1c2a28bcac8e07c233
-
SSDEEP
1536:qJsCf+vKvQfOp4jIuZ/yBJaXKcJVJKIfTPYaRtvqInmFWgi:0tvYOp4j5ksXK0JLRtkFWgi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 36a6e6471f711b0486dbc1bc9d8f5358_JaffaCakes118
Files
-
36a6e6471f711b0486dbc1bc9d8f5358_JaffaCakes118.exe windows:4 windows x86 arch:x86
4553ef701d8b2493e4e2e7511018f0bb
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
VerLanguageNameA
FreeVirtualBuffer
CopyFileA
HeapExtend
lstrcpyn
GetNumaNodeProcessorMask
SetSearchPathMode
FindNextVolumeMountPointA
GetTempFileNameA
EnumSystemLanguageGroupsW
AddConsoleAliasW
Sections
.text Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
rdata Size: - Virtual size: 64KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 49KB - Virtual size: 66KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE