Static task
static1
Behavioral task
behavioral1
Sample
4cc8048c5fd15f1226ea46a0d73e5484_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
4cc8048c5fd15f1226ea46a0d73e5484_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
4cc8048c5fd15f1226ea46a0d73e5484_JaffaCakes118
-
Size
448KB
-
MD5
4cc8048c5fd15f1226ea46a0d73e5484
-
SHA1
ede74595683aaf17156f53a75e5947f29ead95f4
-
SHA256
8e03ebd7328a4caca243e58dc570a0461d1e3c94f350ebb5044b959064edd7cc
-
SHA512
1ed5ae10e51b75c44211a58b6b872150f45ee090eec98c50320888a0f1ccf6a48028201f095da271a721b714f84b54c44be5e0234d9fee44fe249c7067967b2f
-
SSDEEP
6144:AiKezTFRf9Az4xirYFHT4NkTY1ktS0IThxFxkuI/qyzEcp9VRCmjOSOm4ElHu2Tq:Aa94eFHTPkZLPElRwSOUBF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4cc8048c5fd15f1226ea46a0d73e5484_JaffaCakes118
Files
-
4cc8048c5fd15f1226ea46a0d73e5484_JaffaCakes118.exe windows:4 windows x86 arch:x86
2652f7846161f3f502854974719d636d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LockFile
SetFilePointer
CreateFileA
FindFirstFileA
TlsAlloc
GetCurrentProcess
GetProcAddress
GetModuleHandleA
GetLastError
GetProcessHeap
TlsFree
VirtualProtect
ReadFile
VirtualFree
FlushFileBuffers
HeapLock
GetLocalTime
VirtualQuery
RtlUnwind
WriteFile
CloseHandle
UnlockFile
GlobalLock
GetSystemInfo
GetLocaleInfoA
GetStringTypeW
GetStartupInfoA
GetCommandLineA
GetVersionExA
ExitProcess
TerminateProcess
GetStdHandle
GetModuleFileNameA
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
SetLastError
GetCurrentThreadId
TlsSetValue
TlsGetValue
HeapDestroy
HeapCreate
HeapFree
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
GetACP
GetOEMCP
GetCPInfo
HeapAlloc
InitializeCriticalSection
VirtualAlloc
HeapReAlloc
HeapSize
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
user32
EnumWindows
GetClientRect
GetLastActivePopup
IsWindowUnicode
SendMessageA
wsprintfA
IsIconic
gdi32
CreateDIBPatternBrush
GetPixel
advapi32
ImpersonateAnonymousToken
shell32
DuplicateIcon
psapi
GetProcessMemoryInfo
msvfw32
DrawDibGetBuffer
Sections
.text Size: 24KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 108KB - Virtual size: 105KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 148KB - Virtual size: 654KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 164KB - Virtual size: 163KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ