Static task
static1
Behavioral task
behavioral1
Sample
4baac46da5c8925a69df0dc033362cd7_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
4baac46da5c8925a69df0dc033362cd7_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
4baac46da5c8925a69df0dc033362cd7_JaffaCakes118
-
Size
96KB
-
MD5
4baac46da5c8925a69df0dc033362cd7
-
SHA1
cd947e045e7fd56827752aa875cec56fcf033ba1
-
SHA256
15cddfa1bd5f0ce767f655dd7d9f22b3fdccbaf9a3addb925e2c4a2ac675c8a7
-
SHA512
b8cef548092ddc4a13084e144901d693de844a84a1855ff673fb292808573fc476a16b546d23a834e3164bcb9cf44713c3de1abda25bced3a3b132f26c14d8db
-
SSDEEP
1536:lxJPmtGzuIEh5lt3Y7FCqnRUSwfKv5ImurerkUOj6:5Pmtquvh5rY7Nnxwiv5h5rknj6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4baac46da5c8925a69df0dc033362cd7_JaffaCakes118
Files
-
4baac46da5c8925a69df0dc033362cd7_JaffaCakes118.exe windows:4 windows x86 arch:x86
1e4aa8f923f21e76fb1b941c166e3532
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcAddress
CloseHandle
MapViewOfFile
SetProcessAffinityMask
HeapCreate
GetTapeStatus
CreateNamedPipeA
CmdBatNotification
IsBadStringPtrA
SetConsoleNlsMode
WaitNamedPipeA
CreateDirectoryA
RegisterConsoleOS2
MapViewOfFileEx
ReadProcessMemory
lstrcpyn
ReadConsoleOutputA
GetVersionExA
NlsGetCacheUpdateCount
ConvertDefaultLocale
DelayLoadFailureHook
GetBinaryTypeA
HeapSize
GetSystemDefaultLangID
GetCommandLineA
GetStartupInfoA
ExitProcess
GetConsoleScreenBufferInfo
MulDiv
GetVolumeInformationA
InterlockedExchange
IsBadCodePtr
VerifyConsoleIoHandle
GetPrivateProfileSectionA
GlobalSize
EnumUILanguagesA
EnumDateFormatsExA
Sections
.itext Size: 4KB - Virtual size: 96KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
WEIJUNLI Size: 80KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ