Static task
static1
Behavioral task
behavioral1
Sample
3a007fa59f0f434c799d9847f0638b2e_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3a007fa59f0f434c799d9847f0638b2e_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3a007fa59f0f434c799d9847f0638b2e_JaffaCakes118
-
Size
112KB
-
MD5
3a007fa59f0f434c799d9847f0638b2e
-
SHA1
67eb21498744c08fd1df86beac94cfacc5bd502e
-
SHA256
38186d8ceea14a6687e7dec9fb88d12f6be043a505c53785515f1e509803892e
-
SHA512
011ed844deb9e524ff288380beac19981d91fffd70dd2c815621846fa3198adb8d7509b66d0eedb7ebcadd16bcb6c14e92c08e8a65e39458fee4a390e667742c
-
SSDEEP
3072:dGChkvJxfYQblSuSsXOoD8GvN75LQC1jI:ECOBxfYmS8HtvNVLQsj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3a007fa59f0f434c799d9847f0638b2e_JaffaCakes118
Files
-
3a007fa59f0f434c799d9847f0638b2e_JaffaCakes118.exe windows:4 windows x86 arch:x86
2d0a9cbc73014cf3d1c4feacbd5b46b9
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCurrentThread
GetVersionExA
GetCurrentProcess
GetComputerNameA
OpenProcess
GetLastError
CloseHandle
advapi32
FreeSid
GetUserNameA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
GetTokenInformation
AllocateAndInitializeSid
OpenThreadToken
EqualSid
OpenProcessToken
fbclient
ord51
ord248
ord37
ord226
ord225
ord227
ord117
ord173
ord169
ord156
ord166
ord176
ord160
ord162
ord168
ord141
ord115
ord43
ord128
ord1
ord103
ord249
ord250
msvcrt
_stricmp
fprintf
_iob
_close
_except_handler3
_controlfp
__p__fmode
__p__commode
__set_app_type
__setusermatherr
_initterm
_adjust_fdiv
__p___initenv
exit
__getmainargs
_exit
??1type_info@@UAE@XZ
_XcptFilter
_dup2
_open_osfhandle
sprintf
??0exception@@QAE@ABV0@@Z
_CxxThrowException
??0exception@@QAE@XZ
??1exception@@UAE@XZ
strncpy
__CxxFrameHandler
fputc
isprint
free
atol
_errno
getc
atoi
vsprintf
Sections
.text Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 4KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 84KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE