Static task
static1
Behavioral task
behavioral1
Sample
44957f408534e15f1984cb71b0ced6ea_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
44957f408534e15f1984cb71b0ced6ea_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
44957f408534e15f1984cb71b0ced6ea_JaffaCakes118
-
Size
252KB
-
MD5
44957f408534e15f1984cb71b0ced6ea
-
SHA1
2ebacb4852d7291f24045ac9999e3aa4412f2456
-
SHA256
7594dfeb83ff8e9e2dcb719ba76c492b8439dfe5f949a4a0588ec0a37bcd2ef4
-
SHA512
fbc041b859abff3423411cd59aa8298fbaaa6ff1d70df06147268cd92272c4dc4a18e9d1785c65928614d7d36594d0de7f605d66194acbe78aaaa0b96b933730
-
SSDEEP
3072:E5eeu28Q+vTcY45pmIpFV43ddcYTBfRw/NMcrTcVW/d8MfToWzSpIcJ:E5eepQ94FpFVCddcYTBJWMcncnUzSzJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 44957f408534e15f1984cb71b0ced6ea_JaffaCakes118
Files
-
44957f408534e15f1984cb71b0ced6ea_JaffaCakes118.exe windows:5 windows x86 arch:x86
2384298c815de0bb093e7d3b1f234ce5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntdll
strcmp
memset
_chkstk
memcmp
strcpy
_snprintf
strlen
memcpy
_strcmpi
_vsnprintf
RtlRandom
RtlAdjustPrivilege
strstr
_strlwr
kernel32
CreateToolhelp32Snapshot
Process32First
lstrcmpiA
OpenProcess
CreateRemoteThread
Process32Next
VirtualQueryEx
HeapAlloc
GetProcessHeap
HeapFree
HeapValidate
GetTickCount
GetWindowsDirectoryA
OutputDebugStringA
GetCurrentThreadId
GetLastError
ExitProcess
VirtualProtect
CloseHandle
GetModuleFileNameA
CreateMutexA
SetLastError
VirtualAlloc
GetProcAddress
LoadLibraryA
IsBadReadPtr
VirtualFree
ReadProcessMemory
WriteProcessMemory
VirtualProtectEx
VirtualAllocEx
VirtualFreeEx
user32
GetDesktopWindow
Sections
.text Size: 12KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 161KB - Virtual size: 164KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 76KB - Virtual size: 75KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ