Static task
static1
Behavioral task
behavioral1
Sample
59f14855ef680f20ab9a1a17cdc98da6_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
59f14855ef680f20ab9a1a17cdc98da6_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
59f14855ef680f20ab9a1a17cdc98da6_JaffaCakes118
-
Size
13KB
-
MD5
59f14855ef680f20ab9a1a17cdc98da6
-
SHA1
ff1e1c36fb9d372b14d398e282ba68a54b09f585
-
SHA256
6cc22215c5abe75bab92c9332f09f5a1a9592b4133677a19d6aa36e2c80b25f0
-
SHA512
a62ef5f6a66350a6563add8d166df89cbb7f0f9cf71a465e2e1a5b19ea5b346f3e1366cbf3ee481715b00afa1c96813cae128032ec2923044f2b2993acefb3d5
-
SSDEEP
384:KCh2Kl3yfJKOKkIhb1BsIXIZ1G8ROKxv:KCAKJyfKvhhBlYZ1JR7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 59f14855ef680f20ab9a1a17cdc98da6_JaffaCakes118
Files
-
59f14855ef680f20ab9a1a17cdc98da6_JaffaCakes118.exe windows:4 windows x86 arch:x86
ad2a5e7bc74977da90b32c11b590f5bb
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleFileNameA
Sleep
DeleteFileA
lstrcpyA
GetCurrentProcess
SetFileAttributesA
GetFileAttributesA
SetFileAttributesW
WinExec
GetModuleHandleW
GetProcAddress
CloseHandle
VirtualQuery
InterlockedExchange
ExitProcess
GetModuleHandleA
GetCommandLineA
HeapAlloc
HeapFree
SetEvent
GetProcessHeap
WriteFile
OpenProcess
CreateEventA
GetLastError
CreateFileA
GetTempPathA
Process32First
CompareStringA
TerminateProcess
VirtualAlloc
HeapReAlloc
RtlUnwind
user32
wsprintfA
CharToOemA
MessageBoxA
ExitWindowsEx
AnyPopup
ShowWindow
ReleaseDC
gdi32
RestoreDC
advapi32
RegDeleteValueA
RegOpenKeyExA
RegEnumKeyA
RegDeleteKeyA
RegSetValueExA
RegOpenKeyA
RegQueryValueExA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
shell32
ShellExecuteA
Sections
.text Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE