Static task
static1
Behavioral task
behavioral1
Sample
849a3c9b985e9d926ecde1956e75a566_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
849a3c9b985e9d926ecde1956e75a566_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
849a3c9b985e9d926ecde1956e75a566_JaffaCakes118
-
Size
56KB
-
MD5
849a3c9b985e9d926ecde1956e75a566
-
SHA1
f02a7db573bde8357b5eb9a47b6b1fba78a98fd0
-
SHA256
653edab016c3f82ac848be591d2000fe0dfe6430acee3aa849b75b42d8537ee5
-
SHA512
dd0f35f15209da9bf6d7ea0a3f50f96e58cb0a5f99c636bc72d20b4d273c0c4dfc61dba03dc51fc7a05ea566d147d71d3f9dfb01fbbb84eaf3c8f71dfe337d39
-
SSDEEP
1536:y+2Ds6AL2dGp6g3mh04iZFVUW+BFbPHGIDCHmavPqMMw:B2Ds6AL2dGwfG3GavPqZw
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 849a3c9b985e9d926ecde1956e75a566_JaffaCakes118
Files
-
849a3c9b985e9d926ecde1956e75a566_JaffaCakes118.exe windows:4 windows x86 arch:x86
3b8330ff3fe7bb21a7124c9859dcb7fb
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetProcessWorkingSetSize
WaitForSingleObject
GetShortPathNameA
WinExec
GetProcessId
GetTempFileNameA
GetBinaryTypeA
CreateFileA
GetFileSize
SetFilePointer
ReadFile
CreateProcessA
RtlMoveMemory
GetModuleHandleA
ExitProcess
HeapReAlloc
HeapFree
IsBadReadPtr
GetTickCount
FreeLibrary
GetProcAddress
LoadLibraryA
LCMapStringA
GetTempPathA
MoveFileExA
Sleep
RtlFillMemory
HeapAlloc
GetProcessHeap
CloseHandle
OpenProcess
GetOEMCP
DeleteFileA
lstrlen
CreateMutexA
lstrcpynA
OpenMutexA
psapi
EnumProcesses
GetModuleFileNameExA
shlwapi
PathFindFileNameA
PathFileExistsA
user32
wvsprintfA
FindWindowA
PostMessageA
wsprintfA
MessageBoxA
GetAncestor
GetWindowTextA
EnumChildWindows
GetWindowThreadProcessId
EnumWindows
WaitForInputIdle
ShowWindow
urlmon
URLDownloadToFileA
shell32
SHGetSpecialFolderPathA
ShellExecuteEx
SHFileOperationA
wininet
InternetOpenA
InternetOpenUrlA
InternetCloseHandle
InternetReadFile
iphlpapi
GetAdaptersInfo
advapi32
CryptAcquireContextA
RegDeleteValueA
RegDeleteKeyA
RegSetValueExA
RegCreateKeyA
RegCloseKey
RegQueryValueExA
RegOpenKeyA
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptReleaseContext
CryptCreateHash
msvcrt
rand
srand
tolower
_strnicmp
strncmp
??3@YAXPAX@Z
sprintf
_CIfmod
atoi
_ftol
strchr
memmove
modf
free
malloc
strncpy
Sections
.text Size: 47KB - Virtual size: 47KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE