Static task
static1
Behavioral task
behavioral1
Sample
67ba217908134d411b9a21a61443e239_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
67ba217908134d411b9a21a61443e239_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
67ba217908134d411b9a21a61443e239_JaffaCakes118
-
Size
382KB
-
MD5
67ba217908134d411b9a21a61443e239
-
SHA1
09eb146324a981079540babab40b32db150600c9
-
SHA256
5a7db5a14212c6b6e7c6d6146762890db057c7a311ee484929aef83698b8b5d6
-
SHA512
0a4948ec5c0e8967a2474894323cd9d35849ff2caece47114a345786aa5005bd833448f240e52aa5c9fae7f199ba61f874e0fc1e75d96bf052906a2681a77f35
-
SSDEEP
6144:pVRMOlVI8mJ+ehSemWfSZSzuhgrE9dYCb8xf4I7GVltNyEe6EofQKKfnGIYt3yKN:HRMOlVI8mJlmWp6hgricAQG3Xxai5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 67ba217908134d411b9a21a61443e239_JaffaCakes118
Files
-
67ba217908134d411b9a21a61443e239_JaffaCakes118.exe windows:4 windows x86 arch:x86
c7c783c8fdb9730e0aef06f86e2cb38c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetExitCodeProcess
GetStdHandle
LocalFree
GlobalFree
VirtualAlloc
GetEnvironmentVariableW
CreateMutexA
InterlockedExchange
GetModuleHandleW
GetCommandLineA
ResetEvent
GlobalSize
lstrlenA
FindVolumeClose
GetACP
CreateEventA
GetPrivateProfileIntW
CloseHandle
ResumeThread
WriteFile
advapi32
ControlService
RegCloseKey
RegCreateKeyExW
RegQueryValueW
RegEnumKeyW
ClearEventLogW
CreateServiceA
RegDeleteValueA
IsTextUnicode
CloseEventLog
IsValidSecurityDescriptor
IsValidSid
RegDeleteKeyA
asycfilt
DllCanUnloadNow
DllCanUnloadNow
DllCanUnloadNow
DllCanUnloadNow
DllCanUnloadNow
hdwwiz.cpl
InstallNewDevice
Sections
.text Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 416KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 372KB - Virtual size: 371KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ