Static task
static1
Behavioral task
behavioral1
Sample
5ec67d895e6a2e86cc375e397a4fe923_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5ec67d895e6a2e86cc375e397a4fe923_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5ec67d895e6a2e86cc375e397a4fe923_JaffaCakes118
-
Size
72KB
-
MD5
5ec67d895e6a2e86cc375e397a4fe923
-
SHA1
d295d355d8cc1264d2ba91dfcc122e594f79d267
-
SHA256
a0a407257a45f10de76f641b967333cc3e4b387cf999e78550189ce277af4b3f
-
SHA512
2e06dd3c7a150acbdc12d7ad0f08b35dcb0f4ca990f3ac2993a7f4db2d93747d97891bb8f6eb9ed07c9fac1c2c27dfb961135ce7b0e7a9b4f8c0be319d87c022
-
SSDEEP
1536:c7NvDg3TL1BY3LlOg62dWWw3RgdjgAOqhLsA470:c7Nv2BY3Ll34Ww36dsV90
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5ec67d895e6a2e86cc375e397a4fe923_JaffaCakes118
Files
-
5ec67d895e6a2e86cc375e397a4fe923_JaffaCakes118.exe windows:4 windows x86 arch:x86
67f97966665a26bcf33b75ee31383383
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleA
VirtualProtect
ExitProcess
HeapAlloc
GetProcessHeap
UnmapViewOfFile
GetProcAddress
LoadLibraryA
IsBadReadPtr
HeapFree
FreeLibrary
VirtualAlloc
FindResourceA
SizeofResource
LoadResource
VirtualFree
LockResource
HeapReAlloc
GetStartupInfoA
GetCommandLineA
GetVersion
TerminateProcess
GetCurrentProcess
HeapSize
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
RtlUnwind
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetCurrentThreadId
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
GetLastError
WriteFile
GetCPInfo
GetACP
GetOEMCP
InterlockedDecrement
InterlockedIncrement
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
user32
MessageBoxA
advapi32
CryptAcquireContextA
CryptCreateHash
CryptHashData
CryptDeriveKey
CryptDecrypt
Sections
.text Size: 24KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ