Static task
static1
Behavioral task
behavioral1
Sample
9ff2e28565343055bcea30090dcc16a3_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
9ff2e28565343055bcea30090dcc16a3_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
9ff2e28565343055bcea30090dcc16a3_JaffaCakes118
-
Size
465KB
-
MD5
9ff2e28565343055bcea30090dcc16a3
-
SHA1
246266647a7bd81f22dbff150e9099e3aac0c14f
-
SHA256
2a7ec03ed446e33293737f440eb23982bd4328d934ee9cb3c6343f920cb2a94a
-
SHA512
119b064794008ec6f850904512683d22f711d48e7939e1a13f0eeb96bc2d8d23f92aec90c15e72586df62b8e24331a2694fb2ca3999a481958a93bddb9f7237d
-
SSDEEP
12288:+QR/lb5OTsVkBHfyQQEZdZyqYDTarH6fL6i:+elN9VsyzEByrTaH6jn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9ff2e28565343055bcea30090dcc16a3_JaffaCakes118
Files
-
9ff2e28565343055bcea30090dcc16a3_JaffaCakes118.exe windows:4 windows x86 arch:x86
4fbf5faef253eaede6221150b65cbfc6
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
UnhandledExceptionFilter
GetCurrentProcessId
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
SetUnhandledExceptionFilter
GetTickCount
GetCurrentThreadId
DisableThreadLibraryCalls
rpcrt4
NdrInterfacePointerMarshall
NdrProxySendReceive
NdrUserMarshalMarshall
NdrCStdStubBuffer2_Release
NdrStubGetBuffer
NdrConformantArrayBufferSize
NdrPointerFree
NdrConformantStringMarshall
CStdStubBuffer_Connect
NdrStubCall2
IUnknown_AddRef_Proxy
NdrProxyFreeBuffer
NdrCStdStubBuffer_Release
NdrProxyInitialize
NdrConformantStringUnmarshall
CStdStubBuffer_CountRefs
NdrStubForwardingFunction
RpcRaiseException
NdrStubInitialize
CStdStubBuffer_Disconnect
CStdStubBuffer_IsIIDSupported
NdrAllocate
NdrSimpleTypeUnmarshall
NdrClearOutParameters
NdrOleAllocate
NdrDllRegisterProxy
CStdStubBuffer_Invoke
NdrInterfacePointerBufferSize
NdrPointerBufferSize
NdrConformantArrayMarshall
NdrInterfacePointerFree
NdrConvert
NdrDllUnregisterProxy
NdrSimpleTypeMarshall
NdrUserMarshalBufferSize
NdrOleFree
NdrDllCanUnloadNow
NdrInterfacePointerUnmarshall
NdrSimpleStructBufferSize
NdrUserMarshalFree
NdrSimpleStructUnmarshall
NdrSimpleStructMarshall
CStdStubBuffer_QueryInterface
NdrPointerMarshall
IUnknown_Release_Proxy
CStdStubBuffer_DebugServerRelease
NdrPointerUnmarshall
NdrProxyErrorHandler
NdrConformantArrayUnmarshall
CStdStubBuffer_AddRef
NdrDllGetClassObject
NdrConformantStringBufferSize
NdrProxyGetBuffer
IUnknown_QueryInterface_Proxy
CStdStubBuffer_DebugServerQueryInterface
NdrUserMarshalUnmarshall
ntdll
NtAllocateVirtualMemory
RtlUshortByteSwap
LdrGetDllHandle
msvcrt
free
_initterm
malloc
_adjust_fdiv
_except_handler3
Sections
.text Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.data Size: 423KB - Virtual size: 984KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE