Static task
static1
Behavioral task
behavioral1
Sample
48851a2e944739968362a59808b5cd5b_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
48851a2e944739968362a59808b5cd5b_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
48851a2e944739968362a59808b5cd5b_JaffaCakes118
-
Size
168KB
-
MD5
48851a2e944739968362a59808b5cd5b
-
SHA1
488cd5afbfde1081301a7ce14ffb3a2dbe69560b
-
SHA256
1dfe3f95f3ca99f84679bd72cf71da7a8369f4642196a62fa170d8d4bf237eb7
-
SHA512
38114cf0f8995195c20305dc5d0db6d247827687620f67b07508189bab13e04fbd32e2ec52ab970e5a5f0302888f37b369935c856b53af96cf5bbcfc8e57a84f
-
SSDEEP
3072:0496o7IHyB5F0G80zHcWOiGSQOBTLuCgUNi/WOUm777EQGzC8:P96UIHE80zHWjCgu8l777Y
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 48851a2e944739968362a59808b5cd5b_JaffaCakes118
Files
-
48851a2e944739968362a59808b5cd5b_JaffaCakes118.exe windows:4 windows x86 arch:x86
5f83fa3397f8c4b812dc7dbef5b2aa81
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetFileAttributesA
CopyFileA
ReadFile
ReleaseMutex
CreateMutexA
LocalAlloc
AddAtomW
DeviceIoControl
VirtualAlloc
GlobalFree
SetFilePointer
InterlockedIncrement
DeleteCriticalSection
GetCurrentProcessId
GetLastError
GetCurrentThreadId
GetTempPathA
DisableThreadLibraryCalls
GetTickCount
DeleteFileA
EnumResourceNamesA
GetFileAttributesA
GetFileSize
LocalFree
GlobalLock
InitializeCriticalSection
GlobalUnlock
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTempFileNameA
WideCharToMultiByte
GetModuleFileNameW
CheckNameLegalDOS8Dot3W
GetVolumeInformationA
WaitForSingleObject
VirtualFree
CreateFileA
lstrlenA
GetSystemTime
Sleep
CloseHandle
CreateDirectoryA
CreateFileW
GetModuleFileNameA
InterlockedDecrement
MultiByteToWideChar
GetVersionExA
FreeLibrary
advapi32
RegEnumKeyA
RegEnumKeyExA
RegQueryValueExA
RegDeleteKeyA
RegOpenKeyA
RegQueryValueA
RegOpenKeyExA
RegCloseKey
lz32
LZCopy
LZClose
LZOpenFileA
setupapi
CM_Get_Child
SetupDiGetDeviceRegistryPropertyW
CMP_WaitNoPendingInstallEvents
CM_Get_DevNode_Status
Sections
.text Size: 91KB - Virtual size: 487KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 73KB - Virtual size: 73KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ