Static task
static1
Behavioral task
behavioral1
Sample
674e564e604a82cd00bf3914c5ffa691_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
674e564e604a82cd00bf3914c5ffa691_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
674e564e604a82cd00bf3914c5ffa691_JaffaCakes118
-
Size
52KB
-
MD5
674e564e604a82cd00bf3914c5ffa691
-
SHA1
2dd51aeba2bea40c4dfd9c7af8a7da714f2b0570
-
SHA256
462c3f8b6934e5dae42edff0aa78ea8fca41d85d5b4f54a3bb82e3f8cebb7b01
-
SHA512
c3576663a3c419fbc33aaf4ec33c6f8478436f611f7da5775917124a6b4c1b7477b5a9006569ebd66c1a31622ddfdd77626ec68f21ce8e78799dceaaed7e843e
-
SSDEEP
384:6KQKU6HsXhdJgl9Y44gxxd1JcUKUSk4ohjPwQOegfABRfX6LCYi6r1Lciy2XAold:+DbJG9TxfjK1UP8eRf6uqHp84BCo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 674e564e604a82cd00bf3914c5ffa691_JaffaCakes118
Files
-
674e564e604a82cd00bf3914c5ffa691_JaffaCakes118.exe windows:4 windows x86 arch:x86
c31964697c39cf857557644a61410eb4
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetLastError
CreateMutexA
GetProcAddress
LoadLibraryExA
GetLocaleInfoA
ExitProcess
Sleep
DeleteFileA
WinExec
CloseHandle
WriteFile
CreateFileA
GetComputerNameA
GetTickCount
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
HeapAlloc
HeapFree
ReadFile
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
RtlUnwind
VirtualAlloc
HeapReAlloc
SetFilePointer
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
SetStdHandle
FlushFileBuffers
GetCPInfo
GetACP
GetOEMCP
LoadLibraryA
SetEndOfFile
LCMapStringA
LCMapStringW
advapi32
GetUserNameA
Sections
.text Size: 32KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE