Static task
static1
Behavioral task
behavioral1
Sample
76f1732dddca9619ea592e35ed06d6df_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
76f1732dddca9619ea592e35ed06d6df_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
76f1732dddca9619ea592e35ed06d6df_JaffaCakes118
-
Size
48KB
-
MD5
76f1732dddca9619ea592e35ed06d6df
-
SHA1
a30b2cc5b8b9e8ebed6ae97b910e9a9462323933
-
SHA256
891949b110ee2d480a07d58ab8825cb19b539de4ff9075aa32b6692572d116e7
-
SHA512
bdd10c905e4e64eaf9092af16c57e1e6e1b9ceaef86bbf97e23cc861acf379f49bf13a78c6db32d6877fb45e2de9305566f40fd1eeba82d97c1aff9be6338bff
-
SSDEEP
384:ptpqJvFlZcjvQMDGiwu1DIPSHXR9pF+RYaH6Ut33gedxRiyqCmqXjvzXnL0YeCqT:JqtmTjFDaZ6hTDvO69GGv4PWovDAS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 76f1732dddca9619ea592e35ed06d6df_JaffaCakes118
Files
-
76f1732dddca9619ea592e35ed06d6df_JaffaCakes118.exe windows:4 windows x86 arch:x86
dfd3436cd1da8443dd78f7b0d7bd2448
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WaitForSingleObject
CreateProcessA
ExpandEnvironmentStringsA
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
LoadLibraryA
CloseHandle
GetCurrentProcess
ExitThread
ReleaseMutex
GetTickCount
CreateMutexA
WriteFile
CreateFileA
lstrcmpiA
GetLocaleInfoA
GetVersionExA
GetFileAttributesA
CopyFileA
SetFileAttributesA
GetWindowsDirectoryA
lstrlenA
CreateDirectoryA
lstrcatA
GetDriveTypeA
GetLogicalDriveStringsA
TerminateThread
TerminateProcess
OpenProcess
GetStartupInfoA
Sleep
ExitProcess
CreateThread
GetLastError
GetSystemDirectoryA
GetTempPathA
user32
FindWindowA
CharLowerA
msvcrt
_snprintf
strlen
memcmp
strncpy
srand
_vsnprintf
??2@YAPAXI@Z
strcmp
fopen
strcat
memcpy
strstr
strchr
_strlwr
strtok
fread
free
strncat
malloc
_except_handler3
fprintf
fclose
fgets
atoi
__dllonexit
_onexit
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
rand
sprintf
strcpy
memset
_strdup
advapi32
RegDeleteValueA
RegSetValueExA
RegCreateKeyExA
GetUserNameA
RegCloseKey
Sections
.text Size: 32KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 277KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE