Static task
static1
Behavioral task
behavioral1
Sample
49cf755b9e0c99b0efc0d65e70ff3101_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
49cf755b9e0c99b0efc0d65e70ff3101_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
49cf755b9e0c99b0efc0d65e70ff3101_JaffaCakes118
-
Size
559KB
-
MD5
49cf755b9e0c99b0efc0d65e70ff3101
-
SHA1
79fa0cb44beea3718a60150246ed951c85f087a7
-
SHA256
17c795440cadf1030a564c258c8be879307af2b1bbf8d3ed9d48902f2c330db8
-
SHA512
ff334dc6dafa9f4d4e36c6a6f7b5594cbb35c2982527bed2dc7f5fb0773ec593ece5220bc0536e420829b586a1034219607a455e0266ea3c84b376b8bbd67c9c
-
SSDEEP
12288:Q61aUp21XoXRUyPWQ8sXGZ0wechZUjYn5CSbmOeFXAt3LLEUh:39KY2YWQwRZUEn5CGe8Lh
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 49cf755b9e0c99b0efc0d65e70ff3101_JaffaCakes118
Files
-
49cf755b9e0c99b0efc0d65e70ff3101_JaffaCakes118.exe windows:4 windows x86 arch:x86
35f7ecdd5f5a49b3c9a80ecca50041be
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
memset
memcpy
realloc
free
strncpy
strcmp
memmove
strlen
kernel32
GetModuleHandleA
HeapCreate
HeapDestroy
ExitProcess
GetModuleFileNameA
FindResourceA
LoadResource
LockResource
LocalAlloc
LoadLibraryA
GetProcAddress
GetEnvironmentVariableA
LocalSize
LocalFree
HeapFree
HeapAlloc
VirtualAlloc
VirtualFree
VirtualProtect
IsBadReadPtr
GetProcessHeap
FreeLibrary
GetCurrentThreadId
GetCurrentProcessId
InitializeCriticalSection
Sleep
WideCharToMultiByte
HeapSize
GetCurrentDirectoryA
DeleteFileA
WriteFile
CloseHandle
CreateFileA
GetFileSize
ReadFile
SetFilePointer
HeapReAlloc
comctl32
InitCommonControls
user32
MessageBoxA
GetWindowThreadProcessId
IsWindowVisible
IsWindowEnabled
GetForegroundWindow
EnableWindow
EnumWindows
ole32
CoInitialize
Sections
.text Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 28B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 527KB - Virtual size: 526KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ