Static task
static1
Behavioral task
behavioral1
Sample
5fa751d55ee19954e04a3643c88fd00e_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5fa751d55ee19954e04a3643c88fd00e_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5fa751d55ee19954e04a3643c88fd00e_JaffaCakes118
-
Size
92KB
-
MD5
5fa751d55ee19954e04a3643c88fd00e
-
SHA1
8125efb7835a4324a7ca2f332f3b9a6c7af50f6e
-
SHA256
b4595a4fb062b550b5dedb3c929abc97803464b078717cc7e5679efa756feb7a
-
SHA512
4d7e471c9c0b8a53bda43ca583e28769fef66320c4445b61abf1359db9bf158d6593c60f91e000807c91a6cc818e418a098e216668eeb7382d53754f6e6bb85c
-
SSDEEP
1536:1of494T0rS1SD60feu0FKsqSL66WL+nNos0EhMzUsBl7+GbGCM:o49tS1DMgYGi9E+I4l7zan
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5fa751d55ee19954e04a3643c88fd00e_JaffaCakes118
Files
-
5fa751d55ee19954e04a3643c88fd00e_JaffaCakes118.exe windows:4 windows x86 arch:x86
550e85221222ead5ae66b9582deb097a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
InterlockedExchange
GetACP
GetLocaleInfoA
GetVersionExA
RaiseException
InitializeCriticalSection
DeleteCriticalSection
GetProcAddress
LoadLibraryA
lstrcpynA
GetLastError
GetModuleFileNameA
lstrcpyA
CreateDirectoryA
GetTempFileNameA
GetTempPathA
SizeofResource
LockResource
LoadResource
FindResourceA
lstrlenA
SetFilePointer
CreateFileA
CloseHandle
WriteFile
MultiByteToWideChar
InterlockedDecrement
FreeEnvironmentStringsW
GetEnvironmentStrings
LocalFree
GetSystemInfo
VirtualProtect
GetCPInfo
GetOEMCP
GetStringTypeW
GetStringTypeA
IsBadCodePtr
IsBadReadPtr
GetFileType
SetHandleCount
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetStdHandle
LCMapStringW
WideCharToMultiByte
LCMapStringA
ExitProcess
RtlUnwind
HeapFree
GetSystemTimeAsFileTime
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
HeapReAlloc
HeapAlloc
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
VirtualQuery
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
SetUnhandledExceptionFilter
TerminateProcess
GetCurrentProcess
HeapSize
GetEnvironmentStringsW
shell32
SHGetSpecialFolderPathA
shlwapi
StrStrA
PathAppendA
rpcrt4
UuidCreate
ole32
CoCreateInstance
CoInitializeSecurity
CoSetProxyBlanket
CoUninitialize
CoInitializeEx
oleaut32
VariantClear
VariantChangeType
VariantInit
SysFreeString
SysAllocString
Sections
.text Size: 60KB - Virtual size: 57KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 269KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ