Static task
static1
Behavioral task
behavioral1
Sample
5a16386b1efcd8f49e9f8da5ff8aa995_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5a16386b1efcd8f49e9f8da5ff8aa995_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5a16386b1efcd8f49e9f8da5ff8aa995_JaffaCakes118
-
Size
53KB
-
MD5
5a16386b1efcd8f49e9f8da5ff8aa995
-
SHA1
3c620ec5a42d28dc0e8e34549a964d8f0b474539
-
SHA256
41520b34a7491a700ea8794e303ca4320b877ddd6ebddf1d4e32674a9ce99a94
-
SHA512
f3c2603390a0c3393cf850b531aad6a123dd6ea17ed3bc8eef1e1be83fc637617a080e0add543186210bcc5751f97f4e59c10ec3a1c64aa9df3009acc78d0d12
-
SSDEEP
768:SUMa2UIKxMqAAEe5aP4Z6gTYfsQN5hrt0l/4wsiHoCPHCRYjYOpaq:SUb26Y12fTYU0t0l5snRWNl
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5a16386b1efcd8f49e9f8da5ff8aa995_JaffaCakes118
Files
-
5a16386b1efcd8f49e9f8da5ff8aa995_JaffaCakes118.exe windows:4 windows x86 arch:x86
e446c097091e65b2f3cb757d383302e4
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrcpyA
CloseHandle
CreateMutexA
GetProcAddress
MultiByteToWideChar
lstrlenA
GetModuleFileNameA
GetStartupInfoA
LoadLibraryA
FreeLibrary
GetCommandLineA
OpenProcess
GetLastError
GetModuleHandleA
user32
DispatchMessageA
UpdateWindow
TranslateMessage
GetMessageA
KillTimer
PostQuitMessage
SetTimer
DefWindowProcA
PostMessageA
CreateWindowExA
ShowWindow
RegisterClassExA
ole32
CoFreeLibrary
CoLoadLibrary
ws2_32
WSAStartup
gethostbyname
inet_addr
ntohl
WSACleanup
inet_ntoa
gethostname
msvcrt
_controlfp
strcat
_adjust_fdiv
memcpy
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
strstr
atoi
_except_handler3
__set_app_type
__p__fmode
strlen
__p__commode
strncpy
tolower
memset
srand
strcpy
_splitpath
rand
time
Sections
.text Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 1000B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ice Size: 29KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE