Static task
static1
Behavioral task
behavioral1
Sample
a1305e60300f5c03bd47793bb325bb4a_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
a1305e60300f5c03bd47793bb325bb4a_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a1305e60300f5c03bd47793bb325bb4a_JaffaCakes118
-
Size
76KB
-
MD5
a1305e60300f5c03bd47793bb325bb4a
-
SHA1
845cd18664b81f2a9420c6fbb527af5c81f0b434
-
SHA256
c19d6d7c6dd34c4376be0f162a8f932d53cfb89def8f86e55cfb61576f889233
-
SHA512
74488dec690bfee62b739e7cd850e0492ff210211ff062c6aafe42ca0af8ea66e0a3812b29adfeb017f9ac80005b41f83768ad38fc18b0ede72325e484c5e45f
-
SSDEEP
1536:N6a7ivG668cOU/G2qEIgcyN01nQfuoqBDQ31uOjEErxTWDTMqhGKYIZTET8x:cxvS/G2FI7yN01LQ3UOjBkMqhGKZTbx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a1305e60300f5c03bd47793bb325bb4a_JaffaCakes118
Files
-
a1305e60300f5c03bd47793bb325bb4a_JaffaCakes118.exe windows:4 windows x86 arch:x86
21ff9fe7e3aa5238d8ef2c153508e28f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GlobalAlloc
FindAtomW
GetThreadLocale
TryEnterCriticalSection
lstrcmpA
FindAtomW
SetEnvironmentVariableW
IsBadCodePtr
Thread32First
LockResource
GetProcessDEPPolicy
SetConsoleNlsMode
Sections
.text Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
rdata Size: - Virtual size: 64KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 42KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.zrdata Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE