Static task
static1
Behavioral task
behavioral1
Sample
4442d8af63eb715214aeb8344c766a52_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
4442d8af63eb715214aeb8344c766a52_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
4442d8af63eb715214aeb8344c766a52_JaffaCakes118
-
Size
9KB
-
MD5
4442d8af63eb715214aeb8344c766a52
-
SHA1
a5ba7370e4460fa4145d6c29cd58a98546c96f1b
-
SHA256
e9a08c3f0e06bc3d21a35fa8a64acc6bea8c91e75e9de534b6d8c9fe506fcec1
-
SHA512
b54d668f652621e2fce06eac79bfe9a9508ae373211a630234d16edcb5a4030d7dcf2277918cfa47bbffd30242113ead190cb656c1c0f751f62e5257a31e5850
-
SSDEEP
96:+iZFqoMapqgkFHJ60RS+PEHPtboynVFDB+Ije2GlGm4dHz9vEkayp/YF:+ixEgkFHJyHP1oynVFDYImb4hzREOtY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4442d8af63eb715214aeb8344c766a52_JaffaCakes118
Files
-
4442d8af63eb715214aeb8344c766a52_JaffaCakes118.exe windows:4 windows x86 arch:x86
942db656771e650f5abf684f785b4284
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
LookupPrivilegeValueA
OpenProcessToken
AdjustTokenPrivileges
msvcrt
strstr
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
tolower
kernel32
CreateFileA
LoadResource
LockResource
GetStartupInfoA
GetSystemDirectoryA
lstrcatA
GetCurrentProcess
LoadLibraryA
Sleep
CreateToolhelp32Snapshot
Process32First
Process32Next
OpenProcess
VirtualAllocEx
GetModuleHandleA
GetProcAddress
WriteProcessMemory
EndUpdateResourceA
CloseHandle
WriteFile
BeginUpdateResourceA
SizeofResource
CreateRemoteThread
FindResourceA
VirtualFreeEx
GetModuleFileNameA
GetVersionExA
WaitForSingleObject
Sections
.text Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 156B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.packet Size: 4KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE