Static task
static1
Behavioral task
behavioral1
Sample
4b58a5ac42b5f3bce6eebb277eddaee2_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
4b58a5ac42b5f3bce6eebb277eddaee2_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
4b58a5ac42b5f3bce6eebb277eddaee2_JaffaCakes118
-
Size
139KB
-
MD5
4b58a5ac42b5f3bce6eebb277eddaee2
-
SHA1
90ed086e30bf7a31054dec9ad3e1c28ab6ce2884
-
SHA256
7d726472d54dddad523312199c72bc4d86db3797dbf8865e3d7fb262bd64781c
-
SHA512
9ed2127724395e9c47e164efa5613bf9f0f50567b3b0a1703668f5e96296f98300953d939bca6fe078e0ea9bd7ffbc76655544c502e18808a06fc9fc350c0cf0
-
SSDEEP
3072:Hiu9HU+8uZuptAtYxyUocA+jDjA2wv5JCP:FC+3ttYAMf4/CP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4b58a5ac42b5f3bce6eebb277eddaee2_JaffaCakes118
Files
-
4b58a5ac42b5f3bce6eebb277eddaee2_JaffaCakes118.exe windows:4 windows x86 arch:x86
44456722ea1ad84d5238fce7c3bdabae
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateFileA
lstrcatA
GetSystemDirectoryA
ReadProcessMemory
GetCurrentProcess
GetProcAddress
GetModuleHandleA
lstrlenA
LoadLibraryA
GetModuleFileNameA
WriteFile
CloseHandle
FreeLibrary
LocalFree
CheckRemoteDebuggerPresent
ContinueDebugEvent
WaitForDebugEvent
CreateProcessA
IsDebuggerPresent
LocalAlloc
lstrcmpA
GetTempPathA
ExitProcess
GetLastError
DeleteFileA
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
Sleep
VirtualAlloc
HeapReAlloc
RtlUnwind
HeapSize
MultiByteToWideChar
GetLocaleInfoA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
user32
MessageBoxA
advapi32
GetUserNameA
RegOpenKeyExA
Sections
.text Size: 30KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.mydoc Size: 21KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 87KB - Virtual size: 86KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ