Static task
static1
Behavioral task
behavioral1
Sample
650530137a30cfd110dd6b3f93964bd2_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
650530137a30cfd110dd6b3f93964bd2_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
650530137a30cfd110dd6b3f93964bd2_JaffaCakes118
-
Size
43KB
-
MD5
650530137a30cfd110dd6b3f93964bd2
-
SHA1
410913d45605cc40d98efaaa37a3eab444acd64a
-
SHA256
467597e0715d625436e3e2b6dc247ed38d0d5c06593f9d43f743d14b3ca62602
-
SHA512
b1b78c9919501bdda74d38c8d41d23a834e0bcefd1be28a68e12a4b230a419326b25ce03dd8a2e9cab6810a6de31537572e5e7e0588a5cb7d4c6d2024b7b6ae3
-
SSDEEP
768:KAi8xwZziYxCFHupj1N1KR5AwMvBfbV/5J/jf6zdnK/:Kl7Z2uCspxN1w5Aw+BN5JLSRnK/
Malware Config
Signatures
Files
-
650530137a30cfd110dd6b3f93964bd2_JaffaCakes118.exe windows:4 windows x86 arch:x86
93b5201d57470bdee489ff3f4140bac0
Code Sign
41:32:b4:4e:fd:d3:8a:50:bd:ff:3a:42:d1:e2:1e:9fCertificate
IssuerCN=Root ddddddNot Before10/12/2009, 11:58Not After31/12/2039, 23:59SubjectCN=kol.sdppp,O=y,1.2.840.113549.1.9.1=#130e6b696c77656f66646a662e6f706f59:c4:9b:b6:1a:83:9e:ed:11:c0:e3:d5:17:8f:49:d4:23:58:cd:0bSigner
Actual PE Digest59:c4:9b:b6:1a:83:9e:ed:11:c0:e3:d5:17:8f:49:d4:23:58:cd:0bDigest Algorithmsha1PE Digest MatchesfalseHeaders
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
VirtualAllocEx
VirtualFreeEx
VirtualProtectEx
ReadProcessMemory
WriteProcessMemory
CreateProcessA
GetModuleFileNameA
GetCurrentProcess
SetThreadContext
ResumeThread
GetThreadContext
advapi32.dll�
AdjustTokenPrivileges
OpenProcessToken
LookupPrivilegeValueA
msvcrt.dll�
malloc
fclose
??3@YAXPAX@Z
fread
fseek
fopen
free
Sections
.text Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.cw Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CBtrl Size: 35KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE