Static task
static1
Behavioral task
behavioral1
Sample
38c8ac76d59643371c47d116f3a2760a_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
38c8ac76d59643371c47d116f3a2760a_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
38c8ac76d59643371c47d116f3a2760a_JaffaCakes118
-
Size
79KB
-
MD5
38c8ac76d59643371c47d116f3a2760a
-
SHA1
e1668c4715e6741c0eb88d4cac66306e5fa3e2a1
-
SHA256
d4fae19f578d0d57f246b1fe27ce7e9fa7545772b937662bb186b348adf60047
-
SHA512
8167d8992cfc3b3b13c1912067ac35e50cf905f3e5c8028be69536398a8ca5225a7fbabc36e09d01980adbf1a67be8b175fb5492d16c09d88708bb84e82beb39
-
SSDEEP
1536:UTtjMv1ArRmUeKVX8kgbd91vO9KMgX+P7S5sk2ADkrIy2eMBoRYHQK:UBOCgbd91m9xvosktDO6eMZH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 38c8ac76d59643371c47d116f3a2760a_JaffaCakes118
Files
-
38c8ac76d59643371c47d116f3a2760a_JaffaCakes118.exe windows:4 windows x86 arch:x86
f26d059a07e96c159e94302e762231e8
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
SetFileSecurityA
SetFileSecurityW
kernel32
CloseHandle
CompareStringA
CreateDirectoryA
CreateDirectoryW
CreateFileA
CreateFileW
DeleteFileA
DeleteFileW
ExitProcess
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
FindFirstFileA
FindFirstFileW
FindNextFileA
FindNextFileW
GetCPInfo
GetCommandLineA
GetConsoleMode
GetCurrentProcess
GetDriveTypeA
GetFileAttributesA
GetFileAttributesW
GetFileType
GetLastError
GetModuleFileNameA
GetProcessHeap
GetStdHandle
GetSystemTime
GetVersionExA
HeapAlloc
HeapFree
HeapReAlloc
IsDBCSLeadByte
LocalFileTimeToFileTime
MoveFileA
MultiByteToWideChar
ReadConsoleA
ReadFile
SetConsoleMode
SetEndOfFile
SetErrorMode
SetFileAttributesA
SetFileAttributesW
SetFilePointer
SetFileTime
Sleep
SystemTimeToFileTime
WideCharToMultiByte
WriteFile
user32
CharToOemA
CharToOemBuffA
CharUpperA
LoadStringA
OemToCharA
OemToCharBuffA
wvsprintfA
Sections
.text Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ