Static task
static1
Behavioral task
behavioral1
Sample
4a3f009b43c2f7871f2bf9ba73dec082_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
4a3f009b43c2f7871f2bf9ba73dec082_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
4a3f009b43c2f7871f2bf9ba73dec082_JaffaCakes118
-
Size
35KB
-
MD5
4a3f009b43c2f7871f2bf9ba73dec082
-
SHA1
872fef544ffa4a7281c555a1e13e15077d952e40
-
SHA256
f5c8e5645398ad6fcb1d02380f0c4cc240ecb6468118549d7c14cc948b435306
-
SHA512
4db30fa6c110d44f3a626f2729633ab0014519bb9beebb5ced1a6a12afb5db46c00c9455a2ded8bc892052d26070fb8f1b90625e6128bce38ac24cc05e594892
-
SSDEEP
384:eE31is4d+7ywBfPNccohpCGcMJxDTHfRm8rMwGta7qWd0mW:emxc+PdlccohpYMTDT/RmqAaq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4a3f009b43c2f7871f2bf9ba73dec082_JaffaCakes118
Files
-
4a3f009b43c2f7871f2bf9ba73dec082_JaffaCakes118.exe windows:4 windows x86 arch:x86
4d1fd7aff3f2fb11c169e981b68921b2
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetLastError
GetModuleFileNameW
lstrcatW
SetProcessPriorityBoost
SetThreadPriority
GetCurrentThread
SetPriorityClass
GetProcessHeap
GetEnvironmentVariableW
GetShortPathNameW
ExitProcess
DeleteFileW
CreateProcessW
GetTickCount
OutputDebugStringW
ExpandEnvironmentStringsW
GetSystemDirectoryW
HeapAlloc
lstrcmpiW
lstrlenW
HeapFree
lstrcpyW
GetFileTime
SetFileTime
FindResourceW
LoadResource
CreateFileW
SizeofResource
WriteFile
CloseHandle
FreeResource
GetCurrentProcess
Sleep
RtlUnwind
user32
wsprintfW
advapi32
RegOpenKeyExW
RegCreateKeyExW
EnumServicesStatusW
QueryServiceConfigW
RegOpenKeyW
RegQueryValueExW
ChangeServiceConfigW
RegCloseKey
ChangeServiceConfig2W
OpenSCManagerW
OpenServiceW
StartServiceW
CloseServiceHandle
CreateServiceW
RegSetValueExW
shell32
SHChangeNotify
ShellExecuteExW
shlwapi
StrStrW
Sections
.text Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ