Static task
static1
Behavioral task
behavioral1
Sample
722de8325434b4956438c9362f579262_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
722de8325434b4956438c9362f579262_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
722de8325434b4956438c9362f579262_JaffaCakes118
-
Size
16KB
-
MD5
722de8325434b4956438c9362f579262
-
SHA1
86b217217e3a0aa3f36c40f8ef70ed5de67a5f0c
-
SHA256
d8f718c9cf16c48044aa458febac4ff5395328f8ca50ba5d0ff7ea9c76544ed1
-
SHA512
0b09e2d135f170ebac94d6f927c8f5a6078124f790cf51bf95fe8b765e9b83f97539e95eec4eed9365f26a11b418e22893131ce9c4f83b664b0adda80dbc5d92
-
SSDEEP
384:AJ+j5BzGevIJh0OBWMdr9RXwODpUbBxr4H1wbB0TbY9d+cS:RLGb03MdhVDeN1N0Tbc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 722de8325434b4956438c9362f579262_JaffaCakes118
Files
-
722de8325434b4956438c9362f579262_JaffaCakes118.exe windows:4 windows x86 arch:x86
f8e713a4fa969a8960c255f16093d1c6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
rpcrt4
UuidCreate
psapi
EnumProcesses
EnumProcessModules
GetModuleBaseNameA
kernel32
WinExec
lstrcatA
lstrcpyA
DeleteFileA
MoveFileExA
GetTempFileNameA
GetSystemDirectoryA
CreateProcessA
CloseHandle
Sleep
lstrlenA
CreateFileA
lstrcmpiA
GetProcAddress
LoadLibraryA
OpenProcess
GetProcessHeap
GetModuleHandleA
HeapFree
HeapAlloc
ReadFile
GetFileSizeEx
GetTickCount
GetSystemWindowsDirectoryA
SetFilePointer
WriteFile
WaitForSingleObject
ResumeThread
SetHandleInformation
GetTempPathA
RemoveDirectoryA
CreateDirectoryA
FindClose
FindNextFileA
FindFirstFileA
GetDriveTypeA
SetThreadContext
FlushInstructionCache
WriteProcessMemory
VirtualProtectEx
GetThreadContext
GetModuleFileNameA
DuplicateHandle
GetLastError
ExitProcess
GetCurrentProcess
GetFileSize
advapi32
CryptEncrypt
CryptImportKey
CryptAcquireContextA
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA
SetServiceStatus
shell32
ShellExecuteA
SHGetFolderPathA
Sections
.text Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ