Static task
static1
Behavioral task
behavioral1
Sample
5e5103d5eedbb384379f21ba7960176a_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
5e5103d5eedbb384379f21ba7960176a_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5e5103d5eedbb384379f21ba7960176a_JaffaCakes118
-
Size
46KB
-
MD5
5e5103d5eedbb384379f21ba7960176a
-
SHA1
3c27647125f36df9b149e4e56900b29f36315988
-
SHA256
7f151dd40c50068f56f46c0ac2bb48aa91d8b0000c1343d509a1d122e88ca90f
-
SHA512
3c17f9048ca56e849df9cc8218a4600c2d1760198713270ad927e7c99a2812795a21d9b954293d0b8a2e7da1aa7781ad30ddbf54f92a11f19a6ac48aa7832841
-
SSDEEP
768:2kO5UbxMlc1ulJYAX1ErqgQjfYuy53Li3SSl3L50AhNEKlUPcVqZp0QB6Obke0Nr:e5kxEmUJ4q7jfDW3Li3ScNbEJcWpXBde
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5e5103d5eedbb384379f21ba7960176a_JaffaCakes118
Files
-
5e5103d5eedbb384379f21ba7960176a_JaffaCakes118.exe windows:5 windows x86 arch:x86
31b11f25a8d040f3a721d2a1adf2a678
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
CryptReleaseContext
RegDeleteValueA
RegQueryValueExA
CryptCreateHash
RegCloseKey
DuplicateTokenEx
CryptGetHashParam
shlwapi
wvnsprintfA
StrCmpNIW
SHDeleteKeyA
wvnsprintfW
wnsprintfA
StrCmpNIA
PathRemoveFileSpecW
PathFileExistsW
wnsprintfW
StrStrW
PathFindFileNameW
PathMatchSpecW
PathCombineW
Sections
.wjun Size: 36KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ctqdev Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.crylsj Size: 5KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ