Static task
static1
Behavioral task
behavioral1
Sample
65f76b2f584f7870cc22bfe8bb5b76c9_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
65f76b2f584f7870cc22bfe8bb5b76c9_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
65f76b2f584f7870cc22bfe8bb5b76c9_JaffaCakes118
-
Size
316KB
-
MD5
65f76b2f584f7870cc22bfe8bb5b76c9
-
SHA1
4b014c96af5efd0a505d0ec251cbf44b8e2c087a
-
SHA256
e82f998f21831d9eef141360d78e9360d07532fcb94159a94f51ba0fd36c472f
-
SHA512
198c4a307f4c9080852ea47c400532dddd43835a9020740a675c9efd30c1ca8691ca162789492f45b55adf658c739c9e332647ca1359c0070aa3057f4c47cf24
-
SSDEEP
6144:kas4IwFGob3jddoq9xW36lqeWRp5G3FrqcN4apOauzW:kas4Bsuddoq9s3kKCN4awZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 65f76b2f584f7870cc22bfe8bb5b76c9_JaffaCakes118
Files
-
65f76b2f584f7870cc22bfe8bb5b76c9_JaffaCakes118.exe windows:4 windows x86 arch:x86
80a0bb0926af5449b0a630f24eeb03d2
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
advapi32
RegCloseKey
RegSetValueExA
RegCreateKeyExW
RegDeleteValueA
user32
LoadImageW
ScreenToClient
PeekMessageA
ReleaseDC
GetCursorPos
RegisterClassA
GetFocus
IntersectRect
PostMessageA
kernel32
GetStringTypeA
FreeEnvironmentStringsA
TlsSetValue
UnmapViewOfFile
GetTempPathW
GetProcessHeap
GetCurrentThreadId
IsValidCodePage
CompareStringA
GetOEMCP
DeleteCriticalSection
FindNextFileW
GetModuleHandleA
GetVersion
GetACP
GetCommandLineA
GetCurrentProcess
CreateEventA
InterlockedExchange
GetLastError
GetStartupInfoA
SizeofResource
RtlUnwind
GetCurrentProcessId
SetConsoleCP
HeapAlloc
InterlockedIncrement
LeaveCriticalSection
GetFileSizeEx
ExpandEnvironmentStringsW
SetStdHandle
ExitProcess
SetLastError
GetTickCount
SetFilePointer
VirtualProtect
lz32
LZDone
msvcrt
?terminate@@YAXXZ
Sections
.text Size: 139KB - Virtual size: 138KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 170KB - Virtual size: 181KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 494KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 128B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ