Static task
static1
Behavioral task
behavioral1
Sample
5bd6322b9e4ef1ef2ca5c2055142cb74_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5bd6322b9e4ef1ef2ca5c2055142cb74_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5bd6322b9e4ef1ef2ca5c2055142cb74_JaffaCakes118
-
Size
176KB
-
MD5
5bd6322b9e4ef1ef2ca5c2055142cb74
-
SHA1
c65f67a37144b5dcd841fbe82e63041e46d6cbec
-
SHA256
af48de32d1e358280148179a3148d232a8fe1e44baeb28272a9680899f812cb4
-
SHA512
fba3daeb20eb05d8af9a05fcfe6bbbb05375ba4d29b3d9c081d33d6d9455d3f2b355089537e4537f79f2faa704181a6584df14268527ef76b476d32c9c365d7e
-
SSDEEP
1536:AsgA3YkYE+POcbEvR4Q0rO1iNjT5siMcwVSS/ioPn:x3YBEQ1wvR4zrOEtTS7DqoPn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5bd6322b9e4ef1ef2ca5c2055142cb74_JaffaCakes118
Files
-
5bd6322b9e4ef1ef2ca5c2055142cb74_JaffaCakes118.exe windows:4 windows x86 arch:x86
10e61eb0da9a7aff387f713976f94b50
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
IsBadWritePtr
IsBadReadPtr
HeapValidate
ExitProcess
TerminateProcess
GetCurrentProcess
GetCommandLineA
GetVersion
GetLastError
CloseHandle
DebugBreak
GetStdHandle
WriteFile
InterlockedDecrement
OutputDebugStringA
GetProcAddress
LoadLibraryA
InterlockedIncrement
GetModuleFileNameA
HeapAlloc
HeapReAlloc
HeapFree
VirtualFree
VirtualAlloc
GetModuleHandleA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
RtlUnwind
SetStdHandle
FlushFileBuffers
SetConsoleCtrlHandler
SetFilePointer
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
CreateFileA
GetCPInfo
GetACP
GetOEMCP
SetEndOfFile
ReadFile
LCMapStringA
LCMapStringW
Sections
.text Size: 140KB - Virtual size: 137KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ