Static task
static1
Behavioral task
behavioral1
Sample
49f6651e0887763b76d55861fddef621_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
49f6651e0887763b76d55861fddef621_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
49f6651e0887763b76d55861fddef621_JaffaCakes118
-
Size
99KB
-
MD5
49f6651e0887763b76d55861fddef621
-
SHA1
102eb7633457b9877324a5a92b5121187f401664
-
SHA256
3f92883a7c2bf337498a8676e76bd59c570fa4ec14ceba5c096b6eeae933164e
-
SHA512
86633845339f991406470b61efeb98c5fd76c57051b4210c0c771e4e121687492818ae8fcf2ac5ec570e20744e96fb1145844da21e39f5e59aa071b4aae37634
-
SSDEEP
3072:t1LtCTGKRYzaFNp2Tgu10xpUBAELmOuLRdea:t1LtCTGKRY2FNpgguOxSBtFa
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 49f6651e0887763b76d55861fddef621_JaffaCakes118
Files
-
49f6651e0887763b76d55861fddef621_JaffaCakes118.exe windows:1 windows x86 arch:x86
246667c7894354b09bdd4b0924ff921a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
RtlUnwind
user32
MessageBoxA
crtdll
_iob
_itoa
__GetMainArgs
_strnicmp
abort
exit
fputc
fwrite
localeconv
memcpy
memmove
memset
pow
raise
signal
strcat
strchr
strtol
wcslen
wctomb
Sections
.text Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 608B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 88B - Virtual size: 88B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 760B - Virtual size: 760B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE