Static task
static1
Behavioral task
behavioral1
Sample
4a61d7259e5bc8039c885617f330c832_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
4a61d7259e5bc8039c885617f330c832_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
4a61d7259e5bc8039c885617f330c832_JaffaCakes118
-
Size
244KB
-
MD5
4a61d7259e5bc8039c885617f330c832
-
SHA1
58f31adb13aa0509a48cf371268791971dfbe270
-
SHA256
616a50e518ea9e108b8f2c9811ac33119cb1f0c6a0f1de3df5cb2cf66e4c24fc
-
SHA512
36a9048283c03ddae502585660ce6b2b9a450c9f32fcc49a5f1a18c1c5b6623089172467ae61b1b7adfcbe02a919bb99ad67e643fe9ca67031a290544185b33f
-
SSDEEP
6144:oHsUV65Id2L0wHcIwXhv+EhlK7Q5qux9BJiRS:cBV6asQw8ph2EhlPZ9qS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4a61d7259e5bc8039c885617f330c832_JaffaCakes118
Files
-
4a61d7259e5bc8039c885617f330c832_JaffaCakes118.exe windows:4 windows x86 arch:x86
5ffc848e33f0ac241d572cfefec820ab
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCurrentProcess
CloseHandle
GetDriveTypeA
VirtualAlloc
FreeLibrary
GetCurrentThreadId
TlsFree
GetSystemDefaultLangID
GetCurrentProcessId
TlsAlloc
GetModuleFileNameA
Sleep
GetCommandLineA
GetStartupInfoA
TlsSetValue
GetModuleHandleA
GetLogicalDrives
TlsGetValue
GetCurrentThread
GetACP
IsValidCodePage
user32
RegisterClassA
GetActiveWindow
GetWindowLongA
GetFocus
GetDC
ReleaseDC
GetSystemMetrics
GetWindowTextLengthA
GetClassLongA
IsWindowVisible
GetWindowDC
BeginPaint
GetForegroundWindow
GetWindowTextA
ShowWindow
CreateWindowExA
GetWindow
OpenIcon
UpdateWindow
advapi32
RegOpenKeyExA
GetUserNameA
IsTextUnicode
RegCloseKey
RegCreateKeyExA
RegQueryValueExA
version
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerLanguageNameA
Sections
.text Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 596KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ