Static task
static1
Behavioral task
behavioral1
Sample
5d854e68b3d05b6d9c7885bdb6df04c0_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5d854e68b3d05b6d9c7885bdb6df04c0_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5d854e68b3d05b6d9c7885bdb6df04c0_JaffaCakes118
-
Size
324KB
-
MD5
5d854e68b3d05b6d9c7885bdb6df04c0
-
SHA1
f02ba45986f5e247a7819e1e0c9e02d559e9ae11
-
SHA256
60ae16cf8cedcc655be982c51275d464359da4c8c56ff02249fe0ddd08d93346
-
SHA512
3127a063bf259efeb6e186e728af1f6c899c99e50e5ad365b2bc62086dec81b8bb254e9b0c12654c664a40c5f8a46c9f425aea992cdb260b9c1c983d94460277
-
SSDEEP
6144:6JjXdoirAw5bNX7olnuUxjyidjPavMkjRgfWq/T89yqmEm:6jX2iccN6VyiVaxiFhF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5d854e68b3d05b6d9c7885bdb6df04c0_JaffaCakes118
Files
-
5d854e68b3d05b6d9c7885bdb6df04c0_JaffaCakes118.exe windows:5 windows x86 arch:x86
8baf80103f3dbf1110ed71546ab331d7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrcpyW
GetStartupInfoA
FindResourceW
DeleteCriticalSection
lstrlenW
DisableThreadLibraryCalls
lstrcmpiW
LoadResource
EnterCriticalSection
lstrcatW
InitializeCriticalSection
lstrcpynW
GetLastError
HeapDestroy
MultiByteToWideChar
InterlockedDecrement
lstrlenA
FreeLibrary
SizeofResource
GetModuleFileNameW
InterlockedIncrement
LeaveCriticalSection
rpcrt4
RpcStringFreeW
ntdll
NtAllocateVirtualMemory
RtlAdjustPrivilege
RtlAddAccessAllowedAce
msvcrt
wcscpy
__CxxFrameHandler
realloc
_adjust_fdiv
_purecall
free
wcslen
wcsncat
_initterm
_except_handler3
wcsncpy
malloc
advapi32
RegSetValueExW
RegOpenKeyExW
RegQueryInfoKeyW
RegDeleteValueW
RegEnumKeyExW
RegQueryValueExW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
ole32
CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc
oleaut32
VariantClear
user32
CharNextW
Sections
.text Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 298KB - Virtual size: 298KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE