Static task
static1
Behavioral task
behavioral1
Sample
890e36b60da9343f77a3d7e5a1e60516_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
890e36b60da9343f77a3d7e5a1e60516_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
890e36b60da9343f77a3d7e5a1e60516_JaffaCakes118
-
Size
218KB
-
MD5
890e36b60da9343f77a3d7e5a1e60516
-
SHA1
07561bc621f9a2c4e2ba8d7c58d8444b8c8b5737
-
SHA256
03d8ee4d9958ad70ff66da334cf0fee831102c34648862ed3fe9b82a25af14aa
-
SHA512
c0614e3c45738dc01662245ee855420d4c983cd7c0eba3bdab93f43a09d19d5edc88ac8770c025f54d25dc641d4e8ff03f054e006110a2a1de879f6cfd686afe
-
SSDEEP
3072:+cPCtLvtaX/8wzVN1ZdOdXvPy0IiK4fit8sUTNwkklt99WJ5jO:+cMLYX/8whre1bIl38sUTNPkVUn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 890e36b60da9343f77a3d7e5a1e60516_JaffaCakes118
Files
-
890e36b60da9343f77a3d7e5a1e60516_JaffaCakes118.exe windows:4 windows x86 arch:x86
e930fd1c9fd8df42da2cefa3b9ade01c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
FreeResource
WriteFile
DeleteFileA
LockResource
GetProcAddress
LoadLibraryA
FindResourceA
WaitForSingleObject
CreateEventA
GetWindowsDirectoryA
GetTickCount
WinExec
FreeLibrary
LocalAlloc
InterlockedExchange
RaiseException
GetLastError
RtlUnwind
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapFree
GetCurrentThreadId
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
SetUnhandledExceptionFilter
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapAlloc
VirtualAlloc
HeapReAlloc
IsBadWritePtr
IsBadReadPtr
IsBadCodePtr
SetFilePointer
InterlockedDecrement
InterlockedIncrement
GetCPInfo
GetACP
GetOEMCP
SetStdHandle
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
FlushFileBuffers
user32
LoadCursorA
RegisterClassA
LoadIconA
Sections
.text Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 173KB - Virtual size: 173KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ