Static task
static1
Behavioral task
behavioral1
Sample
a46c8f58d05d939ca0c8903f2f7f4413_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
a46c8f58d05d939ca0c8903f2f7f4413_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a46c8f58d05d939ca0c8903f2f7f4413_JaffaCakes118
-
Size
575KB
-
MD5
a46c8f58d05d939ca0c8903f2f7f4413
-
SHA1
e68ed08c1b4a891d78630fe2a0b83fc6afe2801b
-
SHA256
fe110edda3a42017ff31633d7cb6f4afa6ce8579c26396ce766c61925edfad35
-
SHA512
07d0f0f7bb906e51360f1b8f9068421aaf045da26be4f3590fa5877f8008b392d91dc7bccac74667f3a09c5edf1424c3acccbc46c0f2d3b5cec1bb2b06fb000c
-
SSDEEP
12288:XnX1NiVV9aqgvYTgyt2GoZYD5jOXUh3iEB3l:Xn4V9egkyemD1OXCXB1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a46c8f58d05d939ca0c8903f2f7f4413_JaffaCakes118
Files
-
a46c8f58d05d939ca0c8903f2f7f4413_JaffaCakes118.exe windows:4 windows x86 arch:x86
91911e89b5603bb530fcfa1d3ec48eef
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
VirtualProtect
GetCommandLineA
InterlockedExchange
CreateFileW
GlobalAlloc
_llseek
_lwrite
_lclose
GetTempFileNameW
GetTempPathW
InterlockedIncrement
lstrcmpiW
LocalFileTimeToFileTime
DosDateTimeToFileTime
lstrlenW
GetProcessHeap
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
LoadLibraryW
GetModuleFileNameW
GetModuleHandleW
GetStringTypeA
LCMapStringW
LCMapStringA
RtlUnwind
GetModuleHandleA
GetStartupInfoA
GetVersion
ExitProcess
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
WriteFile
GetCPInfo
GetACP
GetOEMCP
HeapAlloc
VirtualAlloc
HeapReAlloc
GetProcAddress
LoadLibraryA
MultiByteToWideChar
GetStringTypeW
ole32
CoInitializeEx
CoUninitialize
Sections
.text Size: 253KB - Virtual size: 253KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 316KB - Virtual size: 623KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ