Static task
static1
Behavioral task
behavioral1
Sample
44791e9bb2ae9f6a6f37e3abcc047070_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
44791e9bb2ae9f6a6f37e3abcc047070_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
44791e9bb2ae9f6a6f37e3abcc047070_JaffaCakes118
-
Size
324KB
-
MD5
44791e9bb2ae9f6a6f37e3abcc047070
-
SHA1
37b38c365cfc6e11ea05c646810c40b78e6c86a0
-
SHA256
a91deb46ce33ab5c9d9ee9ff14cc7f994308e4f2ab195176455062f2598369fb
-
SHA512
ece198a84bfd52e580f8d149210059b5fbb6cd04dcb9df41afa4786033070792fa23871335fc73e8959972d5275035c441cc4e0f041385a61ec41c6c33eeb854
-
SSDEEP
6144:POtxbfGn9sCUPhLU9hcWyBe3K9gAMZdLdR48Wp9jaEbiiONVK:ibHCoW2P9gLLWXjaEbS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 44791e9bb2ae9f6a6f37e3abcc047070_JaffaCakes118
Files
-
44791e9bb2ae9f6a6f37e3abcc047070_JaffaCakes118.exe windows:4 windows x86 arch:x86
18a87f87f94ded940f7dd2549a3e40b9
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Sleep
VirtualAlloc
VirtualFree
VirtualProtect
LoadLibraryA
GetProcAddress
IsValidLocale
GetConsoleMode
FreeLibrary
user32
SendMessageA
Sections
dDwcIRCZ Size: 44KB - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
HhQgaWag Size: 4KB - Virtual size: 460B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
GujgeeQO Size: 272KB - Virtual size: 292KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE