Static task
static1
Behavioral task
behavioral1
Sample
63ea0e66b33356351c71961065456a2b_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
63ea0e66b33356351c71961065456a2b_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
63ea0e66b33356351c71961065456a2b_JaffaCakes118
-
Size
36KB
-
MD5
63ea0e66b33356351c71961065456a2b
-
SHA1
1512bdc9fcfde74bcc809bab2a1239099bc4cc5f
-
SHA256
e6be5ea6cd43d7fa9d37d48a6a4884b0686a99b1cc7a90c1d6301367e7f97c2a
-
SHA512
e727ee717ef8d5bc5d25c16a5a7b6ee2a568f12b2e5b2349a1f9d286a6de446cdc97f2bdef6dfb492959d52b74de8e028f21db3649696902dead5ba4e50df420
-
SSDEEP
768:ASPQK8AwCKe2wvrKW+nuuRBw8KgtPpgOEY1Vm8oBsAsmCXazF/:ASPQCwCKBwvrKFtBw2pVrm20CX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 63ea0e66b33356351c71961065456a2b_JaffaCakes118
Files
-
63ea0e66b33356351c71961065456a2b_JaffaCakes118.exe windows:4 windows x86 arch:x86
0fe906ee3104dc9a4e2f7bf12641e0b8
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetEvent
CreateEventA
CreateToolhelp32Snapshot
Process32Next
CloseHandle
WaitForSingleObject
GetModuleFileNameA
lstrcmpiA
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
RtlUnwind
HeapCreate
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
HeapValidate
TlsAlloc
TlsSetValue
GetCurrentThreadId
TlsFree
GetLastError
TlsGetValue
SetLastError
ExitProcess
GetSystemTimeAsFileTime
GetStartupInfoA
GetFileType
GetStdHandle
GetCurrentProcess
DuplicateHandle
SetHandleCount
GetCommandLineA
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
SetConsoleCtrlHandler
GetConsoleMode
GetConsoleOutputCP
WriteFile
VirtualAlloc
VirtualQuery
MultiByteToWideChar
SetStdHandle
WideCharToMultiByte
SetFilePointer
DeleteFileA
advapi32
SetServiceStatus
RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA
OpenSCManagerA
CreateServiceA
CloseServiceHandle
OpenServiceA
QueryServiceStatus
DeleteService
ws2_32
WSAStartup
WSACleanup
closesocket
Sections
.text Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE