Static task
static1
Behavioral task
behavioral1
Sample
89aba28353834f497e0efe8c316dcadb_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
89aba28353834f497e0efe8c316dcadb_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
89aba28353834f497e0efe8c316dcadb_JaffaCakes118
-
Size
17KB
-
MD5
89aba28353834f497e0efe8c316dcadb
-
SHA1
4fb4db8198a4d5eaf639f8f371672602350c33d6
-
SHA256
5ac19433fb5e632f5c867a215de8a6ba733e870090870c80b19bf5cf95970933
-
SHA512
f30e7e5ca5a3ac73e566ca559f35ab60b3523ba80dd3133398263b5e75b4380ad3e347c491abde0670b4564dbdfba428239e25c101ac7352188eec9a7be65381
-
SSDEEP
192:M0Jv2bI/u9GxxNAmMeCkfYrQX+F7ti9gpSlPchyjt1qhhKe6/Fe2:SE/u9Gfq0V2NFDyjXmTSFe
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 89aba28353834f497e0efe8c316dcadb_JaffaCakes118
Files
-
89aba28353834f497e0efe8c316dcadb_JaffaCakes118.exe windows:4 windows x86 arch:x86
3973e522be8d4753aa92b7ca2bd4e8b2
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
strrchr
kernel32
GetTickCount
Sleep
CloseHandle
WriteFile
CreateFileA
CompareStringA
GetProcAddress
GetModuleHandleA
lstrlenA
GetLastError
GetCurrentProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
VirtualFreeEx
WaitForSingleObject
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
OpenProcess
ExitProcess
WinExec
GetModuleFileNameA
GetEnvironmentVariableA
GetTempPathA
GetWindowsDirectoryA
GetSystemDirectoryA
FreeResource
SizeofResource
LockResource
LoadResource
FindResourceA
CreateMutexA
SetLocalTime
GetLocalTime
LoadLibraryA
CopyFileA
DeleteFileA
CreateThread
GetCurrentProcessId
GetCommandLineA
user32
wsprintfA
DispatchMessageA
TranslateMessage
PeekMessageA
SendMessageA
SetCursorPos
GetWindowRect
FindWindowExA
SetActiveWindow
SetForegroundWindow
FindWindowA
advapi32
RegCloseKey
RegSetValueExA
RegCreateKeyExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
Sections
.text Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ