Static task
static1
Behavioral task
behavioral1
Sample
486cad759599b47310f0863f7ffaaa9e_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
486cad759599b47310f0863f7ffaaa9e_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
486cad759599b47310f0863f7ffaaa9e_JaffaCakes118
-
Size
54KB
-
MD5
486cad759599b47310f0863f7ffaaa9e
-
SHA1
6e656be37726212a007fd20fa7bdeb7c81036345
-
SHA256
7e293c595921e70773faf4f339b7995aec769aab19ab9454d4c08523fb40246a
-
SHA512
bfeb474f495307649b9a1399578818a08cc7870e3fd6ae1fd60ce90d40806be9c3b8ab441578e17dae0db4a5329add024638dc7d438e3aa6f6aa067346903491
-
SSDEEP
1536:poMB4oy7pkr6C+RYWTORUI5DODt8PqCmI:GMVTWSOt8Pq5I
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 486cad759599b47310f0863f7ffaaa9e_JaffaCakes118
Files
-
486cad759599b47310f0863f7ffaaa9e_JaffaCakes118.exe windows:4 windows x86 arch:x86
3b8330ff3fe7bb21a7124c9859dcb7fb
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetProcessWorkingSetSize
WaitForSingleObject
GetShortPathNameA
WinExec
GetProcessId
GetTempFileNameA
GetBinaryTypeA
CreateFileA
GetFileSize
SetFilePointer
ReadFile
CreateProcessA
RtlMoveMemory
GetModuleHandleA
ExitProcess
HeapReAlloc
HeapFree
IsBadReadPtr
GetTickCount
FreeLibrary
GetProcAddress
LoadLibraryA
LCMapStringA
GetTempPathA
MoveFileExA
Sleep
RtlFillMemory
HeapAlloc
GetProcessHeap
CloseHandle
OpenProcess
GetOEMCP
DeleteFileA
lstrlen
CreateMutexA
lstrcpynA
OpenMutexA
psapi
EnumProcesses
GetModuleFileNameExA
shlwapi
PathFindFileNameA
PathFileExistsA
user32
wvsprintfA
FindWindowA
PostMessageA
wsprintfA
MessageBoxA
GetAncestor
GetWindowTextA
EnumChildWindows
GetWindowThreadProcessId
EnumWindows
WaitForInputIdle
ShowWindow
urlmon
URLDownloadToFileA
shell32
SHGetSpecialFolderPathA
ShellExecuteEx
SHFileOperationA
wininet
InternetOpenA
InternetOpenUrlA
InternetCloseHandle
InternetReadFile
iphlpapi
GetAdaptersInfo
advapi32
CryptAcquireContextA
RegDeleteValueA
RegDeleteKeyA
RegSetValueExA
RegCreateKeyA
RegCloseKey
RegQueryValueExA
RegOpenKeyA
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptReleaseContext
CryptCreateHash
msvcrt
rand
srand
tolower
_strnicmp
strncmp
??3@YAXPAX@Z
sprintf
_CIfmod
atoi
_ftol
strchr
memmove
modf
free
malloc
strncpy
Sections
.text Size: 46KB - Virtual size: 45KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE