Static task
static1
Behavioral task
behavioral1
Sample
729a048bb766af2e62f27c2e2c543d4b_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
729a048bb766af2e62f27c2e2c543d4b_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
729a048bb766af2e62f27c2e2c543d4b_JaffaCakes118
-
Size
380KB
-
MD5
729a048bb766af2e62f27c2e2c543d4b
-
SHA1
eb3cf6229f37ed2744f678fb2a659570d95c2042
-
SHA256
04f11656891bbdf2e313d3b9f38f057d23866131bc14de9be0c732d755312c0e
-
SHA512
98459f56fa64ce868ed21785cb8019fe363c7be6245b363ebf2c3426b48c195b14436ec7575554d5eb33866d7e8cb6b9ff2c8522a9bbe35105fcaa7f6f942d83
-
SSDEEP
6144:pEtkRMRiWjhtgYXL7TO6dHyF6EDWVUlMVcZOV6fGhmLjAR73t3ygCkv:OtkRMXlbq6Vxh8MV9VOpO73tokv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 729a048bb766af2e62f27c2e2c543d4b_JaffaCakes118
Files
-
729a048bb766af2e62f27c2e2c543d4b_JaffaCakes118.exe windows:4 windows x86 arch:x86
6ef77b87a7c2b7ba51153d10ba175cd2
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ResetEvent
InterlockedExchange
CreateMutexA
GetACP
GetPrivateProfileIntW
ResumeThread
CreateEventA
CloseHandle
GetEnvironmentVariableW
GetCommandLineA
VirtualAlloc
lstrlenA
GetExitCodeProcess
WriteFile
GetModuleHandleW
LocalFree
FindVolumeClose
GlobalSize
GlobalFree
GetStdHandle
advapi32
IsValidSid
IsValidAcl
CreateServiceA
CloseEventLog
ControlService
IsTextUnicode
RegEnumKeyW
RegDeleteValueA
RegCreateKeyExW
ClearEventLogA
RegQueryValueW
RegDeleteKeyA
RegCloseKey
admparse
AdmClose
ResetAdmDirtyFlag
ResetAdmDirtyFlag
ResetAdmDirtyFlag
ResetAdmDirtyFlag
appwiz.cpl
ConfigStartMenu
Sections
.text Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 416KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 370KB - Virtual size: 370KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ