Static task
static1
Behavioral task
behavioral1
Sample
432e158956d1971b221c7c67db1d4640_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
432e158956d1971b221c7c67db1d4640_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
432e158956d1971b221c7c67db1d4640_JaffaCakes118
-
Size
415KB
-
MD5
432e158956d1971b221c7c67db1d4640
-
SHA1
d84e9d42ab8d817cc324ffb52fad4a623a039afa
-
SHA256
1fe559fa3a207faf8496dad55c0a3b5a4a59ea5a1075b54174f66f87b3e81d6a
-
SHA512
9bf87bdad252cd44f48ec62e9ad5d63a138e031a3605cae8c7d1933c3f27e01588d97db3cc3adc7f31caa7dd8a01ed7155b646297ca91d9b20026af711c9cd9f
-
SSDEEP
6144:PEcGDYJWc3xuelfhRZMTgZHOd75f/Ml6DAEkqfd/e0CAkldcUL8D+gSkL70BXx:PZGD6zzNhRZMTgZaJkAhOdFLmRSy0L
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 432e158956d1971b221c7c67db1d4640_JaffaCakes118
Files
-
432e158956d1971b221c7c67db1d4640_JaffaCakes118.exe windows:4 windows x86 arch:x86
8f889f590a5f16ef94c6e17e2fe5b2a2
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
VirtualAlloc
GetWindowsDirectoryA
LoadResource
SizeofResource
FindResourceA
CreateFileA
GetModuleFileNameA
GetProcAddress
GetModuleHandleA
CloseHandle
WriteFile
DeleteFileA
VirtualFree
HeapAlloc
HeapFree
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
LoadLibraryA
HeapCreate
HeapDestroy
GetFileType
RtlUnwind
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
GetCPInfo
GetACP
GetOEMCP
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
MultiByteToWideChar
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
WideCharToMultiByte
SetHandleCount
GetStdHandle
shell32
ShellExecuteA
Sections
.text Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 24KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc1 Size: 344KB - Virtual size: 344KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 100B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ