Static task
static1
Behavioral task
behavioral1
Sample
4b9a93fdcf923d8e6c2c839cbd8cd809_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
4b9a93fdcf923d8e6c2c839cbd8cd809_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
4b9a93fdcf923d8e6c2c839cbd8cd809_JaffaCakes118
-
Size
64KB
-
MD5
4b9a93fdcf923d8e6c2c839cbd8cd809
-
SHA1
4a086d0124a74be9a54ce3e74458946ed963076c
-
SHA256
47f4628e706c44f4fb22d568a6c006daeb828ffd20fb012526c5d81765804d1a
-
SHA512
e5f3b76fdb4d81386ef30e15d1c5cacc10002514bb7b1832dcb938e8baa3fa5b631a8ffa6f39442635474388264d0edc505ca13d475c4d18d681a3ca15195114
-
SSDEEP
768:+wprLcYkdcC/DVMXdZutOldPQVXa1amOCYDn2CMM/OlTqKaYbZjvHZgdO/C3t1qy:+6BduD2CMYOlP/G
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4b9a93fdcf923d8e6c2c839cbd8cd809_JaffaCakes118
Files
-
4b9a93fdcf923d8e6c2c839cbd8cd809_JaffaCakes118.exe windows:4 windows x86 arch:x86
416fbd368d0d3acfb5277af9784aafc4
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
sprintf
malloc
free
modf
memmove
_CIfmod
_CIpow
strncmp
_ftol
atoi
??3@YAXPAX@Z
strncpy
_strnicmp
user32
TranslateMessage
DispatchMessageA
wsprintfA
GetMessageA
GetWindowThreadProcessId
GetClassNameA
GetWindowTextA
EnumWindows
PeekMessageA
MessageBoxA
kernel32
GetProcessTimes
GetProcessHeap
WriteProcessMemory
ReadProcessMemory
VirtualQueryEx
CreateThread
Process32Next
Process32First
CreateToolhelp32Snapshot
FileTimeToSystemTime
FileTimeToLocalFileTime
CloseHandle
OpenProcess
LCMapStringA
GetStartupInfoA
WaitForSingleObject
Sleep
GetCurrentDirectoryA
IsBadReadPtr
HeapFree
HeapReAlloc
HeapAlloc
ExitProcess
CreateProcessA
GetModuleHandleA
shlwapi
PathFileExistsA
Sections
.text Size: 32KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE