Static task
static1
Behavioral task
behavioral1
Sample
96d6912cc9b1259bd37f3572ced56f03_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
96d6912cc9b1259bd37f3572ced56f03_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
96d6912cc9b1259bd37f3572ced56f03_JaffaCakes118
-
Size
324KB
-
MD5
96d6912cc9b1259bd37f3572ced56f03
-
SHA1
efd05e1ec097fbe6d350e0e219276c13b8a318a9
-
SHA256
ef0eaaa99c0dafaf33dc653a5731ea92e9acefa3afd27b4ce72f19fab5bc4bb6
-
SHA512
c9fee068a1b1d5bc7e6e2dbc6dec17abc815897816663437a17649dda9258c6dcb573c1495d735a54cd9cf7d5d6fb4f51d31167da12cc9600fd15d6685b4031e
-
SSDEEP
6144:N74wz9vlW3I1iPkR5ZInpcKOpPGDOYAryzIUg7Miey00YtLo7f:tpz9fvbWQ29M/QieysLo7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 96d6912cc9b1259bd37f3572ced56f03_JaffaCakes118
Files
-
96d6912cc9b1259bd37f3572ced56f03_JaffaCakes118.exe .ps1 windows:5 windows x86 arch:x86 polyglot
4dcec9b41b2dc4829b7ecb28a9471df2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ole32
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
rpcrt4
RpcStringFreeW
kernel32
lstrcatW
FreeLibrary
LeaveCriticalSection
LoadLibraryExW
lstrcpyW
lstrlenW
lstrcmpiW
GetModuleFileNameW
GetLastError
SizeofResource
GetStartupInfoA
FindResourceW
HeapDestroy
LoadResource
lstrcpynW
DisableThreadLibraryCalls
DeleteCriticalSection
MultiByteToWideChar
InterlockedDecrement
InitializeCriticalSection
lstrlenA
InterlockedIncrement
advapi32
RegCloseKey
RegDeleteValueW
RegOpenKeyExW
RegSetValueExW
RegEnumKeyExW
RegDeleteKeyW
RegQueryInfoKeyW
RegQueryValueExW
RegCreateKeyExW
oleaut32
VariantClear
ntdll
RtlAddAccessAllowedAce
NtAllocateVirtualMemory
RtlAdjustPrivilege
user32
CharNextW
msvcrt
__CxxFrameHandler
_initterm
realloc
wcsncat
wcslen
free
_except_handler3
_purecall
_adjust_fdiv
malloc
wcsncpy
wcscpy
Sections
.text Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 298KB - Virtual size: 298KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE