Static task
static1
Behavioral task
behavioral1
Sample
5c834ee455b2017eabb8b843b74cfd61_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5c834ee455b2017eabb8b843b74cfd61_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5c834ee455b2017eabb8b843b74cfd61_JaffaCakes118
-
Size
380KB
-
MD5
5c834ee455b2017eabb8b843b74cfd61
-
SHA1
f6dbcc7873ee1c99a5b609939ddbc7641f2aaba8
-
SHA256
b6493017408d970ba05991910c6f5cbaa7388516159aefe30ed602d84e90502f
-
SHA512
4c3541733645de47b96aab8fe66000de763abc412e9bd0bbc2b416a2c055555a0cabfd30f5aee910561accec27cd1881a2c4828acc4fa4769cb0a61c6a2c44c6
-
SSDEEP
6144:HEtkRMRiWjhtgYXL7TO6dHyF6EDWVUlMVcZOV6fGhmLjAR73t3ygCkv:ktkRMXlbq6Vxh8MV9VOpO73tokv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5c834ee455b2017eabb8b843b74cfd61_JaffaCakes118
Files
-
5c834ee455b2017eabb8b843b74cfd61_JaffaCakes118.exe windows:4 windows x86 arch:x86
6ef77b87a7c2b7ba51153d10ba175cd2
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ResetEvent
InterlockedExchange
CreateMutexA
GetACP
GetPrivateProfileIntW
ResumeThread
CreateEventA
CloseHandle
GetEnvironmentVariableW
GetCommandLineA
VirtualAlloc
lstrlenA
GetExitCodeProcess
WriteFile
GetModuleHandleW
LocalFree
FindVolumeClose
GlobalSize
GlobalFree
GetStdHandle
advapi32
IsValidSid
IsValidAcl
CreateServiceA
CloseEventLog
ControlService
IsTextUnicode
RegEnumKeyW
RegDeleteValueA
RegCreateKeyExW
ClearEventLogA
RegQueryValueW
RegDeleteKeyA
RegCloseKey
admparse
AdmClose
ResetAdmDirtyFlag
ResetAdmDirtyFlag
ResetAdmDirtyFlag
ResetAdmDirtyFlag
appwiz.cpl
ConfigStartMenu
Sections
.text Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 416KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 370KB - Virtual size: 370KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ