Static task
static1
Behavioral task
behavioral1
Sample
a25b19fbaa2a39ad3957680881da3274_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
a25b19fbaa2a39ad3957680881da3274_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a25b19fbaa2a39ad3957680881da3274_JaffaCakes118
-
Size
58KB
-
MD5
a25b19fbaa2a39ad3957680881da3274
-
SHA1
79d2645130df90618adfa1d30d5864bd7f3c7e75
-
SHA256
3c2bd386f1fea769ea4a5bd64494a77e0162af116731fbc462c1393174ef8fc3
-
SHA512
5e734ece10b90d274b53a253e1ea0d616b8d32bf3e7c80d3de0a3659ea6da3a773e3f412f95c8de6087e0d069241593bc4d0751963a347c4cd3dc09c4f67778a
-
SSDEEP
768:eSD95tA1a9L2FzEO5XZd8t7mlgLoUjigvaoMvaLPzPPrHDtzkrMu78TgNJ:eSR5Aa9L2FzEO5XZ4MmtvbrXNwr6i
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a25b19fbaa2a39ad3957680881da3274_JaffaCakes118
Files
-
a25b19fbaa2a39ad3957680881da3274_JaffaCakes118.exe windows:4 windows x86 arch:x86
bd20bc5fca6f0c44ea9808ceaa365bf8
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetOEMCP
OpenProcess
Sleep
MoveFileExA
GetTempPathA
CreateProcessA
SetProcessWorkingSetSize
WaitForSingleObject
GetShortPathNameA
WinExec
GetProcessId
GetTempFileNameA
GetBinaryTypeA
CloseHandle
RtlMoveMemory
GetModuleHandleA
ExitProcess
HeapReAlloc
HeapFree
IsBadReadPtr
GetTickCount
FreeLibrary
GetProcAddress
LoadLibraryA
LCMapStringA
ReadFile
SetFilePointer
GetFileSize
CreateFileA
RtlFillMemory
HeapAlloc
GetProcessHeap
GetModuleFileNameA
IsDebuggerPresent
DeleteFileA
lstrlen
CreateMutexA
OpenMutexA
lstrcpynA
shlwapi
PathFileExistsA
PathFindFileNameA
PathRemoveFileSpecA
advapi32
RegCloseKey
RegQueryValueExA
RegOpenKeyA
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptReleaseContext
CryptCreateHash
CryptAcquireContextA
RegSetValueExA
RegDeleteKeyA
RegDeleteValueA
RegCreateKeyA
user32
wvsprintfA
FindWindowA
PostMessageA
ShowWindow
WaitForInputIdle
wsprintfA
MessageBoxA
GetWindowTextA
EnumChildWindows
GetAncestor
GetWindowThreadProcessId
EnumWindows
psapi
GetModuleFileNameExA
EnumProcesses
urlmon
URLDownloadToFileA
shell32
ShellExecuteEx
SHGetSpecialFolderPathA
SHFileOperationA
wininet
InternetOpenA
InternetCloseHandle
InternetOpenUrlA
InternetReadFile
iphlpapi
GetAdaptersInfo
msvcrt
_strnicmp
malloc
free
memmove
modf
strchr
_ftol
atoi
_CIfmod
??3@YAXPAX@Z
strncmp
strncpy
rand
srand
tolower
sprintf
Sections
.text Size: 49KB - Virtual size: 49KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE