Static task
static1
Behavioral task
behavioral1
Sample
843ba2c9ba4563573e3ce80f4dc9b00a_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
843ba2c9ba4563573e3ce80f4dc9b00a_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
843ba2c9ba4563573e3ce80f4dc9b00a_JaffaCakes118
-
Size
28KB
-
MD5
843ba2c9ba4563573e3ce80f4dc9b00a
-
SHA1
76a972c3a99a911b4101adb30ca42ee50ca9c2c0
-
SHA256
18a60cfc95b3ba675457d84c5698ee86b403d453769eb8defd4a361c6b3cfc74
-
SHA512
ddb021ebd91f2d555d130119ef04ec7558a75f4b04d07afc437371be6598622a2eced11dc537eca36d2b07bf77a7a91bc4121144809ad4d0ec45b0e332abc702
-
SSDEEP
384:lotX4bG6TYXkEitLGOnceHaOovCAmLqCAMr4+8Xapz03VSwaDC1MM:vbz5HZEAadmOMrUXu03VSZD0MM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 843ba2c9ba4563573e3ce80f4dc9b00a_JaffaCakes118
Files
-
843ba2c9ba4563573e3ce80f4dc9b00a_JaffaCakes118.exe windows:4 windows x86 arch:x86
abecae80d8dc3b15fe78dff29d00e3c9
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
lstrcpyA
CloseHandle
FindClose
FindNextFileA
FindFirstFileA
lstrlenA
CreateDirectoryA
GetModuleFileNameA
ReleaseMutex
GetLocalTime
CreateMutexA
OpenMutexA
GlobalAlloc
GlobalFree
GetStartupInfoA
SetErrorMode
LoadLibraryA
FreeLibrary
GetLastError
GetVersionExA
GetModuleHandleA
GetProcAddress
GetFileAttributesA
GetCurrentProcess
user32
wsprintfA
advapi32
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
cmmsg
CmPutMsg
CmGetLastErrorMsg
CmInitMsg
CmTermMsg
msvcrt
memset
free
malloc
atoi
sprintf
memcpy
_stricmp
fgets
fclose
atol
strlen
strchr
fopen
fsetpos
fread
fgetpos
calloc
strtol
strncpy
strcpy
_snprintf
strftime
localtime
time
strstr
_mbctype
strcat
__p___argv
__p___argc
_except_handler3
_local_unwind2
mktime
fprintf
memcmp
_mbsrchr
_iob
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
_strnicmp
Sections
.text Size: 16KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE