Static task
static1
Behavioral task
behavioral1
Sample
49e8e44ebf7a1199f0539b0010b9caf9_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
49e8e44ebf7a1199f0539b0010b9caf9_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
49e8e44ebf7a1199f0539b0010b9caf9_JaffaCakes118
-
Size
37KB
-
MD5
49e8e44ebf7a1199f0539b0010b9caf9
-
SHA1
c7a8a509085437ceed7f6d2ea6b919041d0f4b51
-
SHA256
19cf47e586c3ebc70a07ef316c2d49107214695862ac6e577f17b2752c4da401
-
SHA512
061513a19a1df0cc8b3593c2699cdf6380c618f7bc1cf1c5c9b0560677993840f6bab2f10478f25cdcf92d1986c6c3ba2b6635f1d8814164890016f14431b12d
-
SSDEEP
768:+tcd3Geth3vP8rRtL6D41Np0Lygh84/+/MNYN6BnboUeBQOm:J3GeLPcb6gqCMNwXUeBo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 49e8e44ebf7a1199f0539b0010b9caf9_JaffaCakes118
Files
-
49e8e44ebf7a1199f0539b0010b9caf9_JaffaCakes118.exe windows:4 windows x86 arch:x86
4011b2dae764abf58e2b30fbded63d62
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetFileAttributesA
GetSystemDirectoryA
CloseHandle
GetLastError
lstrcatA
lstrcpyA
FindFirstFileA
Sleep
ExitProcess
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
HeapAlloc
GetProcessHeap
HeapFree
WriteFile
CreateFileA
SizeofResource
LoadResource
FindResourceA
DeleteFileA
CreateProcessA
ReadFile
OpenProcess
CreateRemoteThread
GetProcAddress
WriteProcessMemory
VirtualAllocEx
GetCurrentProcessId
GetCurrentProcess
Process32Next
lstrcmpA
lstrlenA
Process32First
CreateToolhelp32Snapshot
SetFilePointer
GetModuleFileNameA
FindNextFileA
FindClose
GetTickCount
CreateEventA
GetTempFileNameA
user32
wsprintfA
CharUpperA
advapi32
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueA
Sections
.text Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ