Static task
static1
Behavioral task
behavioral1
Sample
49a3bdf70cd3d4b4f3713b26c0a5497c_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
49a3bdf70cd3d4b4f3713b26c0a5497c_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
49a3bdf70cd3d4b4f3713b26c0a5497c_JaffaCakes118
-
Size
32KB
-
MD5
49a3bdf70cd3d4b4f3713b26c0a5497c
-
SHA1
3fbcc17823b00b1030f7109ff15f94d2b50a7cf9
-
SHA256
4589f2d1299ceba83f1fbe3cdb9273b4cba7cc714bb4f45c209f8114a7e111ce
-
SHA512
52610929f47c6e0d40170d8da7eee7bff8c93aa5a5bf283c622aa74b23007ff506433f8518daebd9cd48e33acf307dbcb9f4e39a32102494ecdc8b5e1dd892f5
-
SSDEEP
384:fi9j+LXHaS+jnzqHM9sbY/E6joaRAV4ecx1f8VoaKJZee:fi9UKpnA20gE6rslYq+fZee
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 49a3bdf70cd3d4b4f3713b26c0a5497c_JaffaCakes118
Files
-
49a3bdf70cd3d4b4f3713b26c0a5497c_JaffaCakes118.exe windows:4 windows x86 arch:x86
bd2db4506bac97cc224dbc7f2eb39701
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
advapi32
RegCloseKey
RegOpenKeyExA
RegSetValueExA
kernel32
AddAtomA
CloseHandle
CreateFileA
CreateToolhelp32Snapshot
DeleteFileA
ExitProcess
FindAtomA
FindClose
FindFirstFileA
FindNextFileA
FreeLibrary
GetAtomNameA
GetDriveTypeA
GetExitCodeProcess
GetLogicalDriveStringsA
GetModuleFileNameA
GetProcAddress
GetShortPathNameA
GetSystemDirectoryA
GetVersionExA
GlobalAlloc
GlobalFree
LoadLibraryA
OpenProcess
Process32First
Process32Next
SetUnhandledExceptionFilter
TerminateProcess
WriteFile
lstrcatA
lstrcpyA
lstrlenA
msvcrt
__getmainargs
__p__environ
__p__fmode
__set_app_type
_cexit
_iob
_onexit
_setmode
abort
atexit
exit
fflush
fprintf
free
getenv
malloc
memset
signal
strcmp
toupper
shell32
ShellExecuteA
user32
ExitWindowsEx
Sections
.text Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 80B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 176B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE