Static task
static1
Behavioral task
behavioral1
Sample
49e5fbeb6abe967ee39fa3badc49bb64_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
49e5fbeb6abe967ee39fa3badc49bb64_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
49e5fbeb6abe967ee39fa3badc49bb64_JaffaCakes118
-
Size
776KB
-
MD5
49e5fbeb6abe967ee39fa3badc49bb64
-
SHA1
210503782ba734100d8014b920a2cecf2e659df5
-
SHA256
37cfaff9ce0054dddad1ebf64991fba8ae041560f488661574b97912966ced7c
-
SHA512
f21494ec27ad6d23afe4b8a7f26ad7fd0d86a8d4a45960274c218d5ed8cbc8a33763c15ce8ff9100885e02af39bb62483476354e90401e2507f91f240baf2cc2
-
SSDEEP
12288:WHS3O5RqdTM96D/WO75HJjRkvhUgpFMwQ/mTNtQc40FgIExOOOOOOOOOO:WS3IRqdAoLxhJVG0wXhiDhTB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 49e5fbeb6abe967ee39fa3badc49bb64_JaffaCakes118
Files
-
49e5fbeb6abe967ee39fa3badc49bb64_JaffaCakes118.exe windows:4 windows x86 arch:x86
0189e42cc500f1e2ea3e50fde27cde47
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
GetCurrentProcess
CloseHandle
LCMapStringA
ExitProcess
LoadLibraryA
CreateFileA
user32
CloseWindow
SetWindowLongA
CharLowerBuffA
CreateWindowExA
wsprintfA
advapi32
RegCloseKey
RegEnumValueA
RegOpenKeyA
RegCreateKeyA
RegDeleteValueA
RegEnumKeyA
RegQueryValueA
RegSetValueA
RegDeleteKeyA
Sections
.text Size: 585KB - Virtual size: 588KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 404KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 172KB - Virtual size: 170KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ