Static task
static1
Behavioral task
behavioral1
Sample
3654848f866a10aae29ecd2ea3181427_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3654848f866a10aae29ecd2ea3181427_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3654848f866a10aae29ecd2ea3181427_JaffaCakes118
-
Size
4.8MB
-
MD5
3654848f866a10aae29ecd2ea3181427
-
SHA1
3e3ee72cb9e0493411363a4c5d60048748bcaa67
-
SHA256
5a44f7f44a35874a660f751288f7806dd00f4b8db508a19d4dfe7e1341002919
-
SHA512
7b88ec31e4d950ba1b2d9bef05b02c08572d424cd92b00d526d8cb3f1cc97c3777145e6e8eebecff2a5e5468563ed23a591de193d6cff169c84d78ec23a024a4
-
SSDEEP
98304:AYO5UzwsLM+M6RkMkIM7lYO5UzwsLM+M6RkMkIM7B:V/b/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3654848f866a10aae29ecd2ea3181427_JaffaCakes118
Files
-
3654848f866a10aae29ecd2ea3181427_JaffaCakes118.exe windows:5 windows x86 arch:x86
ba90ad34d445f6ef742e06891b3f8020
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
HeapFree
HeapAlloc
GetProcessHeap
GetVersionExW
FreeLibrary
GetProcAddress
LoadLibraryW
QueryPerformanceCounter
GetCommandLineW
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleHandleA
TerminateProcess
CreateProcessW
lstrcmpiW
lstrcpynW
CopyFileW
FormatMessageW
GetSystemDirectoryW
GetWindowsDirectoryW
GetFileAttributesW
CreateDirectoryW
OutputDebugStringW
lstrcmpW
CompareStringW
GetSystemDefaultLangID
GetLastError
GetCurrentProcess
GetTickCount
GetStartupInfoA
user32
LoadKeyboardLayoutW
UnloadKeyboardLayout
advapi32
RegCreateKeyExW
RegQueryValueExW
RegSetValueExW
RegOpenKeyExW
RegEnumValueW
RegCloseKey
imm32
ImmInstallIMEW
ole32
CoInitialize
CoUninitialize
shlwapi
SHDeleteKeyW
version
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
msvcrt
exit
_vsnwprintf
memmove
wcsstr
_c_exit
_except_handler3
_XcptFilter
_cexit
_exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
Sections
.text Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 430KB - Virtual size: 431KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ