Static task
static1
Behavioral task
behavioral1
Sample
61f8cba87df68aab023410d7a5a29ee0_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
61f8cba87df68aab023410d7a5a29ee0_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
61f8cba87df68aab023410d7a5a29ee0_JaffaCakes118
-
Size
69KB
-
MD5
61f8cba87df68aab023410d7a5a29ee0
-
SHA1
e9c5d47b74b360b1261ae5776921473438534770
-
SHA256
aa933f20c378c7e6052db636f179d66638ee8faea219f5ec573eacf6f400d574
-
SHA512
8e2ea61dbadbe1880b3fb56dbda36d657b3a598f682d07af119a3a6300cfa669be6e383f22093e9290236a14b52f594a250ab2e71314499e8238d23c6baa1bc0
-
SSDEEP
1536:L2NCqA4kA6fA19k99vs6s2t+999999b6m99999DM999tPUJLBJT:yHPF1mkX2tiLBh
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 61f8cba87df68aab023410d7a5a29ee0_JaffaCakes118
Files
-
61f8cba87df68aab023410d7a5a29ee0_JaffaCakes118.exe windows:4 windows x86 arch:x86
44456722ea1ad84d5238fce7c3bdabae
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateFileA
lstrcatA
GetSystemDirectoryA
ReadProcessMemory
GetCurrentProcess
GetProcAddress
GetModuleHandleA
lstrlenA
LoadLibraryA
GetModuleFileNameA
WriteFile
CloseHandle
FreeLibrary
LocalFree
CheckRemoteDebuggerPresent
ContinueDebugEvent
WaitForDebugEvent
CreateProcessA
IsDebuggerPresent
LocalAlloc
lstrcmpA
GetTempPathA
ExitProcess
GetLastError
DeleteFileA
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
Sleep
VirtualAlloc
HeapReAlloc
RtlUnwind
HeapSize
MultiByteToWideChar
GetLocaleInfoA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
user32
MessageBoxA
advapi32
GetUserNameA
RegOpenKeyExA
Sections
.text Size: 29KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.mydoc Size: 22KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ