Static task
static1
Behavioral task
behavioral1
Sample
81d5d592dfbdc8032e0d57edf38d5e54_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
81d5d592dfbdc8032e0d57edf38d5e54_JaffaCakes118.exe
Resource
win10v2004-20240730-en
General
-
Target
81d5d592dfbdc8032e0d57edf38d5e54_JaffaCakes118
-
Size
64KB
-
MD5
81d5d592dfbdc8032e0d57edf38d5e54
-
SHA1
15681e74373dc0fdf11140a5354de296797072c6
-
SHA256
d639b9ac9846541ba81b3978b401a37c29c221c9a644b40723cd604d9ef59c06
-
SHA512
c55d026d54292d13318087f0bee2ddd1263071cb8d4f6a0736b87633cfef9f63bbe1694748c52bb4ffc1868d96c1b7107d955dd976b55b198ebd8da74e8231d0
-
SSDEEP
1536:nVi0uZ8oI7bfNPkspGiacRd/VYIEMWl/9:nk0uZTIHfVxEi3dYIEMa
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 81d5d592dfbdc8032e0d57edf38d5e54_JaffaCakes118
Files
-
81d5d592dfbdc8032e0d57edf38d5e54_JaffaCakes118.exe windows:4 windows x86 arch:x86
3f5d72f3a6a43c0447cf5b3987e74aba
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrcatA
GetWindowsDirectoryA
GetSystemDirectoryA
WinExec
CloseHandle
WriteFile
CreateFileA
CreateToolhelp32Snapshot
GetCurrentProcess
CreateProcessA
MoveFileA
GetCommandLineA
GetStartupInfoA
Process32First
GetCurrentProcessId
Process32Next
OpenProcess
DeleteFileA
TerminateProcess
GetSystemTime
LoadLibraryA
GetProcAddress
FreeLibrary
GetModuleFileNameA
Sleep
SetFileAttributesA
lstrcpyA
GetModuleHandleA
ExitProcess
HeapFree
ReadFile
HeapAlloc
GetProcessHeap
GetFileSize
CopyFileA
GetLocalTime
lstrlenA
WritePrivateProfileStringA
GetPrivateProfileStringA
SetFilePointer
lstrcmpiA
user32
MessageBoxA
CharUpperBuffA
wsprintfA
advapi32
CloseServiceHandle
SetServiceStatus
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegisterServiceCtrlHandlerA
OpenSCManagerA
OpenServiceA
CreateServiceA
ChangeServiceConfigA
ChangeServiceConfig2A
StartServiceA
StartServiceCtrlDispatcherA
psapi
GetModuleFileNameExA
Sections
.text Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ