Static task
static1
Behavioral task
behavioral1
Sample
491876c2137f37e12a54a5331efc5940_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
491876c2137f37e12a54a5331efc5940_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
491876c2137f37e12a54a5331efc5940_JaffaCakes118
-
Size
162KB
-
MD5
491876c2137f37e12a54a5331efc5940
-
SHA1
f5a66a34b69ceea5310b9dc7f4822f3aed93623a
-
SHA256
8d068d71e5da623d4b1c7274c13bca9a327e848349a07484f0abd73067587411
-
SHA512
7ef4eea20361bf33fb1fb8e7733226d2a3e3d2cadf3564ae0b4f7c7e12d0159fd28c86ee0786d2677b787b929907cd3ff1f665e0f6b6c0cba110b560b6b2a4c1
-
SSDEEP
768:Cqsw7Mzgv4BnhpGnS0BXAV8Jbdd/wU8gsQIh6pcoEQm83QCNOkQ63ndo:lw8gBnDzOwV8h3wU6QGA5Em37Ma3n
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 491876c2137f37e12a54a5331efc5940_JaffaCakes118
Files
-
491876c2137f37e12a54a5331efc5940_JaffaCakes118.exe windows:1 windows x86 arch:x86
d4973f11c0b38c6681e55b05b1f266fd
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCurrentThreadId
GetProcAddress
HeapReAlloc
lstrlenW
HeapReAlloc
GetACP
GetCurrentProcessId
ReadFile
GetCurrentProcessId
SetLastError
HeapDestroy
DeleteCriticalSection
GetCurrentProcess
HeapDestroy
lstrcpyW
lstrcpyW
GetModuleHandleW
ReadFile
GetStartupInfoW
GetCommandLineA
CreateThread
CreateFileW
GetACP
GetLastError
SetLastError
GetACP
FormatMessageW
EnterCriticalSection
WaitForSingleObject
GetCommandLineW
InterlockedIncrement
ReadFile
MultiByteToWideChar
GetLastError
GetCommandLineW
QueryPerformanceCounter
user32
GetDC
UpdateWindow
MoveWindow
GetSystemMetrics
ReleaseCapture
MapWindowPoints
DispatchMessageW
Sections
Size: 143KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
�vmp0 Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ