Static task
static1
Behavioral task
behavioral1
Sample
5fe949a9dabcb3f2091bd575ca779c94_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5fe949a9dabcb3f2091bd575ca779c94_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5fe949a9dabcb3f2091bd575ca779c94_JaffaCakes118
-
Size
636KB
-
MD5
5fe949a9dabcb3f2091bd575ca779c94
-
SHA1
8a7caebae3b895477766a79242ca1d7fff90c27b
-
SHA256
572ac8c3f6e62e9b474cec4c5811766fe69c1bd5f16ef1fca16814c065bd24c0
-
SHA512
acfcbb6ad14068cc840e50752acb08bd803db3cf077c3245db103a9bbfd62976168d8b666072bda9882aa7750d1ce33eae8059d3126492181e1d747196724329
-
SSDEEP
12288:2lWX70ib+Fg8kX44OVARiM09L7qssFxmbEBD8+BXljfr+u:2uwib+u8kX44eARifLWssHoObBXljS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5fe949a9dabcb3f2091bd575ca779c94_JaffaCakes118
Files
-
5fe949a9dabcb3f2091bd575ca779c94_JaffaCakes118.exe windows:4 windows x86 arch:x86
cce3172117fe7977dcf8756c3996d09e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GlobalUnlock
GetConsoleCP
HeapReAlloc
CloseHandle
GetModuleHandleA
GetSystemDefaultLangID
LocalSize
GetTickCount
SuspendThread
LoadLibraryExA
GetVersion
lstrlenA
VirtualProtect
WaitForMultipleObjects
GetStdHandle
GetCommandLineA
CompareFileTime
GetAtomNameA
HeapCreate
InterlockedExchange
WaitForSingleObject
gdi32
EqualRgn
BeginPath
DeleteObject
CreateFontA
GetRgnBox
EndPath
GetFontData
GetStringBitmapA
GetMetaFileA
DeleteDC
AbortPath
CreateICA
FloodFill
Ellipse
EngLineTo
GetTextColor
GdiFlush
Escape
GetMetaRgn
CreatePalette
winmm
auxGetVolume
PlaySoundA
CloseDriver
auxSetVolume
OpenDriver
secur32
AddCredentialsA
Sections
.text Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1024B - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ