Static task
static1
Behavioral task
behavioral1
Sample
3be72f67cd7ceb9e9a0cb1b22f1ecc44_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3be72f67cd7ceb9e9a0cb1b22f1ecc44_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3be72f67cd7ceb9e9a0cb1b22f1ecc44_JaffaCakes118
-
Size
54KB
-
MD5
3be72f67cd7ceb9e9a0cb1b22f1ecc44
-
SHA1
78dbbbf91da7d3f8571a25506144ba5c1425a56a
-
SHA256
77a1d7ad629aca19dc7203f3854cdd4b954dcfb265bc54a578a03fc2f4a59f21
-
SHA512
477d62d5b1b2964752d4f5320d5058f65889e28e32b68c207906c255b4caee7564a0898270ada82b63998238a1ff5f5ea2fdd35499790893d4ce5400d0a587fa
-
SSDEEP
1536:poMB4oy7pkr6C+RYWTORUI5DODt8PqxmI:GMVTWSOt8PqUI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3be72f67cd7ceb9e9a0cb1b22f1ecc44_JaffaCakes118
Files
-
3be72f67cd7ceb9e9a0cb1b22f1ecc44_JaffaCakes118.exe windows:4 windows x86 arch:x86
3b8330ff3fe7bb21a7124c9859dcb7fb
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetProcessWorkingSetSize
WaitForSingleObject
GetShortPathNameA
WinExec
GetProcessId
GetTempFileNameA
GetBinaryTypeA
CreateFileA
GetFileSize
SetFilePointer
ReadFile
CreateProcessA
RtlMoveMemory
GetModuleHandleA
ExitProcess
HeapReAlloc
HeapFree
IsBadReadPtr
GetTickCount
FreeLibrary
GetProcAddress
LoadLibraryA
LCMapStringA
GetTempPathA
MoveFileExA
Sleep
RtlFillMemory
HeapAlloc
GetProcessHeap
CloseHandle
OpenProcess
GetOEMCP
DeleteFileA
lstrlen
CreateMutexA
lstrcpynA
OpenMutexA
psapi
EnumProcesses
GetModuleFileNameExA
shlwapi
PathFindFileNameA
PathFileExistsA
user32
wvsprintfA
FindWindowA
PostMessageA
wsprintfA
MessageBoxA
GetAncestor
GetWindowTextA
EnumChildWindows
GetWindowThreadProcessId
EnumWindows
WaitForInputIdle
ShowWindow
urlmon
URLDownloadToFileA
shell32
SHGetSpecialFolderPathA
ShellExecuteEx
SHFileOperationA
wininet
InternetOpenA
InternetOpenUrlA
InternetCloseHandle
InternetReadFile
iphlpapi
GetAdaptersInfo
advapi32
CryptAcquireContextA
RegDeleteValueA
RegDeleteKeyA
RegSetValueExA
RegCreateKeyA
RegCloseKey
RegQueryValueExA
RegOpenKeyA
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptReleaseContext
CryptCreateHash
msvcrt
rand
srand
tolower
_strnicmp
strncmp
??3@YAXPAX@Z
sprintf
_CIfmod
atoi
_ftol
strchr
memmove
modf
free
malloc
strncpy
Sections
.text Size: 46KB - Virtual size: 45KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE