Static task
static1
Behavioral task
behavioral1
Sample
41d76c7e7e14d86968713225ecb00845_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
41d76c7e7e14d86968713225ecb00845_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
41d76c7e7e14d86968713225ecb00845_JaffaCakes118
-
Size
72KB
-
MD5
41d76c7e7e14d86968713225ecb00845
-
SHA1
3f18cac40eb796a0cf71b073c9a367468aa2de09
-
SHA256
61ac32a7f520772ceae8eb39bdecb42c419e6be6c6c852418e91d8b9c4929a60
-
SHA512
301a109d846f85a8b424d6de0d56c16d8cb76a4e355a42306977a15502747549b40133693b449535ebf8b90480c5ecd72a7d95ee82dffb4b5b6eefc38fb351ac
-
SSDEEP
1536:0xceJ6soMgc2bNEdFydXdWvmznFWhj45camKZAt9:tIoM6XNognFWhj45oOAt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 41d76c7e7e14d86968713225ecb00845_JaffaCakes118
Files
-
41d76c7e7e14d86968713225ecb00845_JaffaCakes118.exe windows:4 windows x86 arch:x86
c37dade0acec67ac6a20b6aebd298d15
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetPriorityClass
lstrcatA
lstrcpyA
GetEnvironmentVariableA
GetShortPathNameA
GetModuleFileNameA
CloseHandle
GetCurrentProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
OutputDebugStringA
DeleteFileA
Sleep
GetWindowsDirectoryA
GetCurrentThread
OpenProcess
SetThreadPriority
GetStringTypeA
ReadFile
SetEndOfFile
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
HeapFree
HeapAlloc
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetLastError
FlushFileBuffers
WriteFile
TerminateProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
HeapCreate
VirtualFree
RtlUnwind
VirtualAlloc
HeapReAlloc
SetStdHandle
SetFilePointer
CreateFileA
GetCPInfo
GetACP
GetOEMCP
GetProcAddress
LoadLibraryA
GetStringTypeW
advapi32
OpenProcessToken
CreateProcessAsUserA
shell32
SHChangeNotify
ShellExe
Sections
.text Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 51KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE