Static task
static1
Behavioral task
behavioral1
Sample
48b99b579060810ae57e56c3d72172e0_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
48b99b579060810ae57e56c3d72172e0_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
48b99b579060810ae57e56c3d72172e0_JaffaCakes118
-
Size
50KB
-
MD5
48b99b579060810ae57e56c3d72172e0
-
SHA1
12dffbc36cc9f8dc967c4a046b8241ea277d2d43
-
SHA256
1ec16c835fb7c51b03dab68090cabe307cb4f32fad08a2eed6d3dc451b4e28dc
-
SHA512
4a0482c3b44427256f8b9b6c35b6694fce95201d06a01c4caca1de9713f01713cb4862248972ff4e8322858866d32001d79d0b8334081ab122498637c0b6e293
-
SSDEEP
768:ZZEUsez15YvsEglfuTmCluox2l+//f9wh35+qXnf7fhDCd78tLQ:AKksE/mGVxN//f96JxLY5F
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 48b99b579060810ae57e56c3d72172e0_JaffaCakes118
Files
-
48b99b579060810ae57e56c3d72172e0_JaffaCakes118.exe windows:5 windows x86 arch:x86
23317db6c6bcc16cf24df7f3c9b43320
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
DuplicateTokenEx
kernel32
lstrcmpiA
shlwapi
PathFindFileNameW
PathMatchSpecW
StrCmpNIA
StrCmpNIW
StrStrW
wnsprintfA
wnsprintfW
wvnsprintfW
user32
CharLowerBuffA
CloseDesktop
EndDialog
ExitWindowsEx
GetDlgItem
GetForegroundWindow
GetKeyState
GetWindowTextA
GetWindowThreadProcessId
SetProcessWindowStation
Sections
.wjwryl Size: 40KB - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vot Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.nqzih Size: 5KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ