Static task
static1
Behavioral task
behavioral1
Sample
8c0d8e426ca923014ac5f0e55d999113_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
8c0d8e426ca923014ac5f0e55d999113_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
8c0d8e426ca923014ac5f0e55d999113_JaffaCakes118
-
Size
9KB
-
MD5
8c0d8e426ca923014ac5f0e55d999113
-
SHA1
aef521e2b330235d5961afd236d5d9c9898a45c4
-
SHA256
bb39c258d42adb20eda7754426d574e3c240156a5cff99242fa2cfb3af9e8d5d
-
SHA512
1ff90fe4590c5dbf9d8e994be29084a2cf121ae1f1e394335e860a768d406db886c3e1ab2c0a50a8eec66d57093872ebee826187f47f17f4e8498b012cbb9a98
-
SSDEEP
192:0dpYB3vc/qKwHTgAOiTsoDXGV8FnbhQ6X6Zi:0dpYR0/qKQ1OiT/DWCFnbhrEi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8c0d8e426ca923014ac5f0e55d999113_JaffaCakes118
Files
-
8c0d8e426ca923014ac5f0e55d999113_JaffaCakes118.exe windows:5 windows x86 arch:x86
2d58d43b53dc8285aa7ee0b3811dd8b4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateRemoteThread
OpenProcess
GlobalAlloc
Sleep
ReadProcessMemory
GetProcAddress
VirtualProtectEx
GlobalFree
GetExitCodeThread
GetModuleHandleA
CloseHandle
GetVersion
WriteProcessMemory
SuspendThread
WaitForSingleObject
AllocConsole
GetCurrentProcess
Process32First
GetStdHandle
FindFirstFileA
GetLastError
LoadLibraryA
Process32Next
GetModuleFileNameA
CreateMutexA
CreateToolhelp32Snapshot
IsDebuggerPresent
SetUnhandledExceptionFilter
SetThreadContext
GetThreadContext
ResumeThread
ExitProcess
UnhandledExceptionFilter
TerminateProcess
user32
MessageBoxA
advapi32
LookupPrivilegeValueA
OpenProcessToken
AdjustTokenPrivileges
msvcr100
setvbuf
_open_osfhandle
_fdopen
_crt_debugger_hook
printf
__iob_func
_strlwr
_stricmp
memset
Sections
.text Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 448B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 620B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ