Static task
static1
Behavioral task
behavioral1
Sample
a4af014678e62e3e0112e49cbb8c30de_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
a4af014678e62e3e0112e49cbb8c30de_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a4af014678e62e3e0112e49cbb8c30de_JaffaCakes118
-
Size
268KB
-
MD5
a4af014678e62e3e0112e49cbb8c30de
-
SHA1
eb47f0df1a363e57b44265132a9fb2371b7600e9
-
SHA256
6c36fd8fbbf976712986629a660ad05441b9a994941b8510b8e9b4cbfdae3cfa
-
SHA512
8e1696f9b7d130ca0cc23461a3cd69dcd65e74af01325bc52f073a4a23e5a6c831bcc3cd6bd4a6e208d1976421491fb90c033d9c6b64bfe9f90c217b0b39eb0e
-
SSDEEP
6144:YpyADvVz4Ssiv9tJwZeNZmLETLIV9Co2E3oR8BeiN5URGutyIIx:Yph8SLyMNcASoHOgiIRzt/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a4af014678e62e3e0112e49cbb8c30de_JaffaCakes118
Files
-
a4af014678e62e3e0112e49cbb8c30de_JaffaCakes118.exe windows:4 windows x86 arch:x86
3376d2e35b036e8b53fe20ebac8523cc
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
WideCharToMultiByte
GetCurrentThreadId
LCMapStringA
AddAtomA
DeleteCriticalSection
lstrcpyA
GetEnvironmentStringsW
MulDiv
GetTickCount
GetModuleHandleA
lstrcpynA
LCMapStringW
Sleep
IsBadCodePtr
WriteFile
GetFileAttributesA
lstrcmpA
lstrcmpiA
SetFilePointer
FlushFileBuffers
GetStringTypeW
FreeLibrary
GetLastError
GetThreadLocale
GetProcAddress
InitializeCriticalSection
FreeEnvironmentStringsW
SetStdHandle
UnhandledExceptionFilter
GetStringTypeA
EnumResourceNamesW
GetEnvironmentStrings
LeaveCriticalSection
EnterCriticalSection
lstrlenA
VirtualProtect
lstrcatA
GetStartupInfoA
CreateFileA
ReadFile
GetDiskFreeSpaceA
MultiByteToWideChar
lstrlenA
SetUnhandledExceptionFilter
FindFirstFileA
FreeEnvironmentStringsA
GetCPInfo
IsBadReadPtr
GetFullPathNameA
GetOEMCP
LoadLibraryA
RaiseException
setupapi
CM_Get_Global_State
SetupDiGetDeviceRegistryPropertyW
CMP_WaitNoPendingInstallEvents
CM_Get_DevNode_Status
Sections
.text Size: 136KB - Virtual size: 280KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128KB - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ