Static task
static1
Behavioral task
behavioral1
Sample
3a97be9be0c0e17857e68e62d9674731_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3a97be9be0c0e17857e68e62d9674731_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3a97be9be0c0e17857e68e62d9674731_JaffaCakes118
-
Size
90KB
-
MD5
3a97be9be0c0e17857e68e62d9674731
-
SHA1
2ea4382f2413276d55797c6678fbcd15f81962d0
-
SHA256
987d0ce95306a75517ae06dc104949075b4c1465fd1cebac1cdd9c9acda01476
-
SHA512
af9b10670cb738d7ae9c5c9870cb675153b734e5eae833844d5e4acdb98b2b0e179d987516c52785e690883ea853786861e4192ed709b0ecfe4a6fb5c320708f
-
SSDEEP
768:SmWsBPTMlnkDIYL/5Z3CdPmes/WfZXqSth/W8trrZCpJdlMGPjj23DYBz:hZBTMFkDIoRJCdYKqwFW8FIpRMo23m
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3a97be9be0c0e17857e68e62d9674731_JaffaCakes118
Files
-
3a97be9be0c0e17857e68e62d9674731_JaffaCakes118.exe windows:4 windows x86 arch:x86
613e621a8edd132c52f1e3599f9d7269
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FindVolumeClose
FindAtomA
GetTickCount
Sleep
lstrlenA
TlsGetValue
SearchPathA
DeleteCriticalSection
ReleaseMutex
SetEvent
CreateThread
GetStartupInfoA
GetLastError
GetCalendarInfoA
GetModuleHandleA
FindResourceExA
CreateMutexA
FindClose
CloseHandle
VirtualProtect
advapi32
RegLoadKeyA
CloseEventLog
IsValidSid
GetFileSecurityA
RegCloseKey
RegEnumKeyExA
OpenEventLogA
FreeSid
RegCreateKeyExA
LsaFreeMemory
LsaClose
CloseTrace
AccessCheck
LsaSetSecret
RegCloseKey
msdtcuiu
DllRegisterServer
DtcPerfClose
DllGetClassObject
DtcPerfOpen
DtcPerfCollect
Sections
.text Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1024B - Virtual size: 522B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE