Static task
static1
Behavioral task
behavioral1
Sample
8bdd8a36d696d95841d6c7aed1a5c889_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
8bdd8a36d696d95841d6c7aed1a5c889_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
8bdd8a36d696d95841d6c7aed1a5c889_JaffaCakes118
-
Size
143KB
-
MD5
8bdd8a36d696d95841d6c7aed1a5c889
-
SHA1
a532e4e8aa279268cf9381eeeda5c90961f900a2
-
SHA256
65c1e9408e25c9c636d6c229fd5348b89ef2a89d078273d5cb8d9a776e9536b1
-
SHA512
7bfa83e2aaf0ed83b11cbd74bf441f15ef42ea5114ad13eb82bf6afd687aafa0ca9cdaa73350ca2a0606ff61bf2e2ee9d62a1a2ffbde74b00bc9fe6308cb9bec
-
SSDEEP
1536:JylL3kZaFcgXaAe2bzhxstyMG0Tt9T17be6+W1x+kaBLj/Xz/:JcLUBmvDP+tB17be6+W1x+bBH/Xz/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8bdd8a36d696d95841d6c7aed1a5c889_JaffaCakes118
Files
-
8bdd8a36d696d95841d6c7aed1a5c889_JaffaCakes118.exe windows:4 windows x86 arch:x86
7f124b0e0b7cca42e0a8aa5e3d1ba8a9
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
CreateFileW
GetProcessHeap
HeapAlloc
HeapFree
GetLastError
GetCommandLineW
lstrlenA
lstrlenW
CloseHandle
MultiByteToWideChar
GetModuleHandleW
GetProcAddress
GetCurrentProcess
WriteFile
SetEnvironmentVariableW
CompareStringW
CompareStringA
FlushFileBuffers
SetStdHandle
LoadLibraryA
RtlUnwind
GetFileAttributesW
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
HeapReAlloc
TerminateProcess
HeapSize
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
SetFilePointer
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
GetCPInfo
GetACP
GetOEMCP
user32
MessageBoxExW
wsprintfW
CharUpperW
advapi32
RegCloseKey
OpenSCManagerW
OpenServiceW
DeleteService
CloseServiceHandle
RegDeleteKeyW
RegEnumKeyExW
LookupPrivilegeValueW
AdjustTokenPrivileges
InitializeAcl
GetAce
AddAce
SetNamedSecurityInfoW
OpenProcessToken
GetNamedSecurityInfoW
IsValidAcl
IsValidSid
FreeSid
RegOpenKeyExW
RegCreateKeyExW
RegDeleteValueW
RegSetValueExW
RegQueryValueExW
shell32
CommandLineToArgvW
oleaut32
SysAllocString
SysAllocStringLen
SysFreeString
SysStringLen
Sections
.text Size: 56KB - Virtual size: 55KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 56KB - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ