Static task
static1
Behavioral task
behavioral1
Sample
41bc2462632c207dd7c4a07f426c2a73_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
41bc2462632c207dd7c4a07f426c2a73_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
41bc2462632c207dd7c4a07f426c2a73_JaffaCakes118
-
Size
489KB
-
MD5
41bc2462632c207dd7c4a07f426c2a73
-
SHA1
3921a37e3af7903101b1823b6a0c225b59dd751f
-
SHA256
f73ea78111526c303e9e3bfe46dfd74b4e0bc1c2ffffeadc12c93654e0fc713e
-
SHA512
2128437bb41c06b3ffb4930e3cbef35c3f0e728891134e2218d15c523094e1b22a36e65a1b3a9b2dba49513b5f7790f1fb0cb9dbebe03b65dc701e28cd13da48
-
SSDEEP
12288:KedTMJmCCZXaI5MOvgDfhDIOjITIJAO4:vTMJ9wXbMv1DIO6IJA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 41bc2462632c207dd7c4a07f426c2a73_JaffaCakes118
Files
-
41bc2462632c207dd7c4a07f426c2a73_JaffaCakes118.exe windows:5 windows x86 arch:x86
9c1f8caac1cd5d04432ca38346a36a9a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
_wmakepath
_wsplitpath
_wcsnicmp
iswctype
wcscpy
wcsncat
wcschr
_adjust_fdiv
malloc
_initterm
free
wcslen
_wcsicmp
kernel32
HeapFree
GetPrivateProfileIntW
GetPrivateProfileStringW
lstrcpyW
GetModuleFileNameW
LoadLibraryW
GetLastError
HeapSize
IsBadWritePtr
lstrcpynW
GetProcAddress
FreeLibrary
GetCurrentProcess
CloseHandle
SetEvent
SetEndOfFile
SetFilePointer
CreateFileW
FreeResource
LockResource
LoadResource
FindResourceW
WaitForSingleObject
CreateThread
CreateEventW
GetProfileStringW
IsBadReadPtr
GetModuleHandleW
LeaveCriticalSection
EnterCriticalSection
GetTickCount
DeleteCriticalSection
Sleep
InitializeCriticalSection
lstrcmpiW
AllocConsole
GetStdHandle
SetConsoleScreenBufferSize
HeapAlloc
OutputDebugStringW
FreeConsole
GetProcessHeap
WriteFile
lstrlenW
Sections
.text Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.4Q3l3 Size: 450KB - Virtual size: 449KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 228B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ