Static task
static1
Behavioral task
behavioral1
Sample
5c46e0d1be0ffc0b39b70aebb4aedbc5_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5c46e0d1be0ffc0b39b70aebb4aedbc5_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5c46e0d1be0ffc0b39b70aebb4aedbc5_JaffaCakes118
-
Size
44KB
-
MD5
5c46e0d1be0ffc0b39b70aebb4aedbc5
-
SHA1
8cc6e37e5a558066ccfd9e466c1551118a04fc7b
-
SHA256
45d760e2aef10a21ebcd11856b93e0f690b80d306123281002cf47d16d875e30
-
SHA512
e7d8c593e2fc214dc651fe46fe9381e11e0a26e73951c68d34f842145c952a0ef74228018a1554c9a48b58a0254fc1304ba44eefd97bc77d602b979c7cf3cbb0
-
SSDEEP
384:e2iPr499ZSgw4onKhbnIgNOtVj5JNBtKVwctjjCi3tmycEQDEBNVUPdoGjkgI:e2M4BVJonKhbJOtVdTAjGGmbEBsPdo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5c46e0d1be0ffc0b39b70aebb4aedbc5_JaffaCakes118
Files
-
5c46e0d1be0ffc0b39b70aebb4aedbc5_JaffaCakes118.exe windows:4 windows x86 arch:x86
291132baaa0eebf10842d5381b260fbf
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CopyFileA
Sleep
GetModuleFileNameA
CreateThread
CloseHandle
UnmapViewOfFile
MapViewOfFile
WinExec
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
ReadFile
SetEndOfFile
FindFirstFileA
GetSystemDirectoryA
CreateFileMappingA
lstrcatA
LoadLibraryA
GetProcAddress
ExitProcess
TerminateProcess
GetCurrentProcess
GetLastError
DeleteFileA
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
HeapFree
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
RtlUnwind
WriteFile
HeapAlloc
VirtualAlloc
HeapReAlloc
SetStdHandle
FlushFileBuffers
CreateFileA
SetFilePointer
GetCPInfo
GetACP
GetOEMCP
GetStringTypeW
user32
EnumWindows
EnumChildWindows
GetClassNameA
FindWindowA
SendMessageA
advapi32
RegSetValueExA
RegCloseKey
RegOpenKeyExA
ws2_32
WSAStartup
Sections
.text Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE