Static task
static1
Behavioral task
behavioral1
Sample
3995537481507aa382973a05b488654f_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3995537481507aa382973a05b488654f_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3995537481507aa382973a05b488654f_JaffaCakes118
-
Size
15KB
-
MD5
3995537481507aa382973a05b488654f
-
SHA1
3735242a85e220ab2a4c8999760451641744410e
-
SHA256
ca9807d5e5ef6273ccca3aff14e53b19fddac62b0f8a6d7b81e2957971113e8e
-
SHA512
ed4850f475a3fd6af3df440575af9530947371f72d7715f567eb0c881ef42fa6ae470568fe0edd43a1188a07d72191efb2157f689b57752cf65e6541c94fe980
-
SSDEEP
384:syiTuPMnrDWdR7d78icFMcceDvkhm5WBmI:dUrydR7l8Blb+W4R
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3995537481507aa382973a05b488654f_JaffaCakes118
Files
-
3995537481507aa382973a05b488654f_JaffaCakes118.exe windows:4 windows x86 arch:x86
ac3bac8feebb0c44d3531b2314ac09b6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Sleep
CreateProcessA
DeviceIoControl
GetCurrentProcess
FindAtomA
GetCurrentDirectoryA
DeleteFileA
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GetTickCount
GetVersionExA
ReadFile
GetProcessHeap
CreateDirectoryA
WriteFile
FindFirstFileA
FindNextFileA
FindClose
CreateFileA
GetModuleHandleA
LoadLibraryA
GetProcAddress
ExitProcess
CloseHandle
GetFileAttributesA
CopyFileA
TerminateProcess
user32
InvalidateRect
MessageBoxA
DrawTextA
GetWindowTextA
LoadIconA
SetCursor
GetClassLongA
ScreenToClient
advapi32
OpenServiceA
QueryServiceStatusEx
ControlService
DeleteService
CloseServiceHandle
CheckTokenMembership
RegQueryValueExA
AllocateAndInitializeSid
RegConnectRegistryW
OpenSCManagerA
GetTokenInformation
OpenProcessToken
CreateServiceA
StartServiceA
FreeSid
Sections
.text Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 162KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE